I'm a HTTPS noob, can you explain how or why someone would tamper it on normal HTTP? Who would care to target me and what are the chances that NYT has been tampered with ever before?
How? By being the user's ISP.
Why? To inject adverts.
What are the chances it affected nytimes.com? Almost certain.
Behold: http://arstechnica.com/tech-policy/2014/09/why-comcasts-java... - and that's not the only case of it.
Not only do ISPs do it, but wifi hotspots, dodgy wifi routers, malware on anything in-between, and in some (admittedly rare cases) your government.
And the why isn't just ads. But passive tracking (ISPs have been known to analyze your traffic passively and sell that information), active tracking (the famous Verizon super cookie), "page optimization" which frequently breaks sites, and in some cases malware injection into images, executables, or anything else the bad actor could do automatically.