This suggests that code name for Debian version that includes apt 2.5.6 is "bullseye", and that the list of components in that Debian version doesn't include "non-free-firmware".
B. Checking apt 2.6.1 (the version available in my Debian/bookworm)
This suggests that code name for Debian version that includes apt 2.6.1
is "bookworm", and that the list of components in that Debian version
does include "non-free-firmware".
You can also download apt 2.6.1 (e.g. apt_2.6.1_amd64.deb) from http://ftp.debian.org/debian/pool/main/a/apt/ and verify contents of the sources.list file in question. It includes "bookworm" as code name, and it
does include "non-free-firmware" as a component for binary packages' repo.
The list shows that bookworm was released in 06.2023, whereas this
ticket was created in 02.2023, i.e. before an official release.
My guess is that not including Debian release names in apt's source
files would have some benefits (a bit more flexibility), but on the
other hand the current approach with .ent files most probably also
has some benefits.
It looks like the issue described in the ticket is not a valid problem.
If there will be no feedback in a ~week then I will close this ticket.