While reading the JSON-LD specification I noticed that a lot of vocabularies have http as a protocol instead of https (see section 2. Conformance). This seems odd to me. When opening in a browser there is often a http -> https redirect (like for http://www.w3.org/ns/prov# ).
My question: Is there a best practice which protocol shall be used for IRIs? Am I right, that the fact that http occurs so often in 2. Conformance is that those vocabularies are relatively old?!
HTTPS is HTTP over TLS.
In the context of vocabularies and namespaces these URIs are just opaque strings, they will never be visited so whether the scheme is http or https doesn't matter for security. Maybe software will compare those strings if they match to know what type of document it is, but nothing will visit those URIs.
Just use whatever URI is defined in the standards that you follow, use the same exactly. So if the standard says http:// use that, and if it says https:// then use that, don't change them. Know that it has no impact on security.
Older standards use the http protocol, and newer standards may use the https protocol, but it really doesn't matter, they're just opaque strings to match against, not to connect to.