Why does SameSite=None need Secure?

The answer

Because MDN states that when SameSite=None is used, the Secure attribute must also be set, and current browsers reject a SameSite=None cookie without it. A cookie that travels across sites should at least be protected from plain HTTP interception. A correct header is Set-Cookie: widget=xyz; Secure; SameSite=None; Path=/. Even then, browsers that block or partition third-party cookies may still withhold the cookie.