Sure, if you have the time and opportunity to check that the certificate renewal has worked properly every 60 days. Once you've written a cron job, of course, to do the renewal.
For someone who's primary task isn't IT that's probably not something they want to worry about or will forget about until people complain that the SSL is broken.
Probably better to throw $ to her to buy a multi-year SSL cert from a vendor.
These sites do want to maintain security, so their users can keep coming back rather than getting copyright strikes or worse fines and getting scared off. That doesn't stop them from putting viruses in the ad banners, but that is not getting their users arrested.
Try a quick survey of the most popular pirate sites and see how many support HTTPS. You might be pleasantly surprised.
My point is that by using HTTPS, these sites have demonstrated a higher level of proficiency with security tools than many more popular mainstream sites. I agree the scammy fake download buttons are a problem though, but that's what ad-blockers are for...
The firewall cannot do deep packet inspection on encrypted connections, since it cannot decrypt the data: https://en.wikipedia.org/wiki/Deep_packet_inspection
For example a firewall would see that you entered Google.com but not what you searched