They have a network of voluntary mirrors using very different stacks that give them storage and bandwidth for free. Similar to Debian's APT [0].
VideoLAN isn't in a position to enforce it's hosts to serve the files over TLS.
However the cryptography of the signature check will be updated in the future.