Why? Why not serve the ISO over HTTPS?
There are workarounds for this (using a redirector service and unique hostnames) but that is an additional request of donors who are providing them a lot of bandwidth for free.
It’s not a great reason, but it is a reason.