I think you're correct. The cost for an SSL certificate is trivial for any legitimate company, and the processing overhead to encrypt every request hasn't been a concern for years.