Section 5 heading reads:
5 Security (non-normative)
5.1 Introduction
It is strongly recommended that Server implementations that offer TLS [RFC5246] should use TCP port 8883 (IANA service name: secure-mqtt).
For 3.1.1 we say:
5 Security
5.1 Introduction
This Chapter is provided for guidance only and is Non Normative. However, it is strongly recommended that Server implementations that offer TLS [RFC5246] SHOULD use TCP port 8883 (IANA service name: secure-mqtt).
While it's true that the section is provided as implementer guidance only, the intent of the 3.1.1 wording to make a strong recommendation for using TLS on 8883. It's primarily a cosmetic change, but reverting to the 3.1.1 style makes it consistent