Its incredibly hard for publishers to do https, where main revenue is from serving third party content embedded inside.

Wired has nice article about their efforts going https https://www.wired.com/2016/04/wired-launching-https-security...