The vulnerability, on the high level, is that the Steam app doesn't verify that the store page comes from Valve, meaning that if you own a Wifi hotspot you can potentially scam and cheat the users of the Steam app. This wouldn't have been possible with basic use of SSL by the app.

That's what makes this bizarre – the negligence of developers, the triviality of the fix and the complete lack of understanding from people who are supposed to be reviewing security issues.

How is this not? Steam clients are basically glorified web views for the Shop portion and user regularly enter credit card details in them to buy games or hardware. User also might have virtual currency or valuable stuff in their account worth a lot of real money and users trust everything that's inside theses clients.

So by MITM any unencrypted connection to Steam server either credentials or payment info.

The software is vulnerable to a MITM attack. There's no reason it should be.