Security.txt is now officially RFC 9116

> The file MUST be accessed via HTTP 1.0 or a higher version, and the file access MUST use the "https" scheme (as per Section 2.7.2 of [RFC7230]).

Why the Security.txt file should not be downloaded via http? I mean is this particular measure a security thing or a security theatre one.