HTTPS adds very little privacy in this context. The mirror IP address is in cleartext.

Also, a smart observer might be able to detect APT traffic by analyzing the timing.

If you want privacy, APT supports Tor and there are mirrors providing onion services:

https://blog.torproject.org/debian-and-tor-services-availabl...