Ad injectors on public wifi is a marginal 'risk' considering this page is targeted to professionals and informed hobbyists anyway, who will predominantly just be browsing from home, work or with a VPN that tunnels traffic through either a server they control or a service provider's server whom they trust anyway.

“Specialists” drinking the Kool-Aid look most depressing. Don't you find it strange that each time each proponent believes it's important to mention a stereotypical script kiddie on a public WiFi, something that doesn't bother a lot of people at all because of they way they connect to internet, and hasn't been a common occurrence even in the days of completely broken wireless security protocols?

What is/was common is internet providers' interest in making money on personal behavioral data in the traffic they transfer. DPI boxes to passively gather statistics or actively inject ads (and even rewrite existing ads) have been offered and tested since the 2000s across the world. Scale of big ISPs would make them Google's (&Co) competitors on personal behavioral data market, and mobile ISPs would combine it with location data, too. Moreover, they would be able to use Google's own tracking cookies to track individual users instead of inventing the classification systems (either by observing them in clear text, or by injecting scripts). The security and income of web services is the real reason for the global “HTTP is deprecated, switch to HTTPS” campaign, not you and your “privacy”.