How does BigPipe have an effect if my traffic is mostly anonymous and behind varnish?
This really depends on the content of the page. Taking away any content depending on the logged-in user there might be no dynamic part left which could have any effect.
Additionally, why does the second request bypass Varnish?
As mentioned in the module description it is ...
Any value for the expire column that is different from CacheBackendInterface::CACHE_PERMANENT (-1) is considered a timestamp, indicating when the cache entry could be deleted. In the case of NULL, the value means the cache entry could be deleted in any moment.
As @4k4 said in his comment, data in cache tables are deleted when cron tasks run, and that doesn't ...
The code depends on host name and IP address. So you could add the cache contexts url.site and ip:
$response = new TrustedRedirectResponse('https://site.ch/');
In this case, though, caching doesn't make much sense because it doesn't save many ...