As are some VPNs. It's concerning that so many people route all their traffic (when connected) over some unknown third parties network. Default gateway and server pushed DNS. Only HSTS and certificate pinning would prevent their traffic being sniffed or tampered with.