If your browser can be hijacked by visiting a webpage, the threat vector is not substantially different whether the website is HTTPS or not. It changes the attack path from a MITM attack to a watering hole attack but that doesn't overly raise the difficulty level.

The real threat in this case was that sending the right string of data to a browser let a malicious actor execute a RCE and install malware. Either you trust the browser to be secure against such attacks or you can't trust much of anything.