Maybe its just that they don't understand what they are doing, I don't want to place blame on somebody for doing something unawares. But it is extremely important nowadays to keep an eye out for these kinds of things.
You know who you are. I see what you're up to.
I might not be a wizard with code, but I know enough about network security to call BS on that. https://developers.google.com/web/fundamentals/security/encrypt-in-transit/why-https
Its never necessary unless a service requires it, but https is a prerequisite for having any vague shot at anonymity online.