Comment by Crosseye_Jack

Because your are redirected to one.one.one.one via the location header and 301 status code from the ip address.

http://1.1.1.1 redirects to https://1.1.1.1 which then redirects to https://one.one.one.one

but the TLS cert on https://1.1.1.1 (or https://[2606:4700:4700::1111] on ipv6) is still valid for the ipaddress otherwise your browser would put up a warning during the tls handshake.