I finally found it, after more than a week. Technically I could have noticed it in all the examples on the internet, but it is NEVER explicitly stated and static.
When using no tls “tcp://broker”, when using tls “ssl://broker”
I got the idea somewhat from Github, since the tts stack apparently used to only accept mqtt:// and paho uses only the two above. In your Python example the connect() seems to choose that automatically. In Golang it has to be prefixed.
Edit: It might be still more server side since as far as I understood it, the thingsserver translates the incoming protocols into mqtt or mqtts before processing. So other brokers may have different properties regarding procol usage. Maybe that could be mentioned in the docs then. Paho in Python is surely more common, but it apparently dodges common issues another paho language might have.