Debian testing - upgrade "Buster" to "Bullseye" version, no server for security.debian.org

From https://wiki.debian.org/Status/Testing

deb http://security.debian.org testing-security main contrib non-free
deb-src http://security.debian.org testing-security main contrib non-free 

The entries slightly changed after the latest release.

Its a little bit confusing, but

If you are tracking testing or the next-stable code name, you should always have a corresponding deb http://security.debian.org <"testing" or codename>-security main line in your /etc/apt/sources.list . See this FAQ-Item. https://www.debian.org/security/faq#testing:

Q: How is security handled for testing?

A: Security for testing benefits from the security efforts of the entire project for unstable. However, there is a minimum two-day migration delay, and sometimes security fixes can be held up by transitions. The Security Team helps to move along those transitions holding back important security uploads, but this is not always possible and delays may occur. Especially in the months after a new stable release, when many new versions are uploaded to unstable, security fixes for testing may lag behind. If you want to have a secure (and stable) server you are strongly encouraged to stay with stable.

I think you should NOT disable the security updates for testing and keep a line like

deb http://security.debian.org testing-security main