Google found a threat model where attackers inject http:// .exe links into https:// web pages. This exposes a flaw in mixed-content handling, where web pages don’t allow http:// resources to be loaded - but DO allow resources to be downloaded. Addressing that flaw for all file types would probably break a lot of the internet, but not for .exe (in their apparent estimation). I look forward to hearing what the Firefox and Edge teams think of this.

TLDR: In this approach, http:// sites can link http:// executables, but https:// sites cannot.