It's not about ISPs fiddling with HTTP, it's about using existing reverse proxies / load balancers, such as nginx, haproxy, perlbal, pound, etc. None of them work in HTTP mode with the spec currently in the wild. If you use a non-layer7 balancer, you lose the ability to inject X-Forwarded-For. It's a real concern for sites that serve websocket traffic from more than one machine.