From personal experience .dev is a little weird. For one thing its on the HSTS preload list, enforcing https. You cannot make a http://... request to a .dev domain from most browsers. I found this out the hard way after trying to use .dev for... development.

I understand using http on localhost and in some cases local domains accessible within the LAN. But I don't see much point in using http for public domains, especially since browsers apply many restrictions to insecure origins (http://*.localhost is considered secure).

why not use localhost which most browsers have no issues validating? .dev being on HSTS is a positive imo

That's a deal breaker for me. Who has the time to set up full crypto protocols when just noodling around?