General sanity aside, the whole exploit hinges on the fact that they used string parsing to check for the prefix "http". This wouldn't have been exploitable if they used a proper URL library.
One could easily fuck usage of a library. Common sense is required.
Attempting to ban "http" as a method of ensuring "https", is obviously less ideal than ensuring "https"... by checking for "https".
It also made it clear that trying to use a URL to restrict stuff is a bad idea. Like the dell updater could only load signed requests which means an attacker would have to get dell's private key for signing.
I wouldn't characterize it as "pure laziness" - more a questionable feature
Replacing:
bool flag2 = file.Location.ToLower().StartsWith("http://");
bool flag2 = Regex.IsMatch(file.Location.ToLower(), "^http:");