MITM injecting code on your page that visitors'browsers will happily execute. That's not hypothetical, some ISPs do it.