Satisfying the connection security requirements

Yes and no.

You could rent a server that gives you a free domain name as part of their package, but you might struggle to be able to install whatever software you need to operate.

Or use a System like AWS, but the domain names are dynamic, and then you’d have to send a new version (of the extension) every time it changes.

So in short, buy what you need, it’s easier.

Depends on the domain name TLD you want.

I use letsencrypt, so yes thats fine