Someone might inject javascript into the page? You should not be allowing RCE anyway.
Someone might MITM? Cloudflare does this with https anyway.
Companies might spy on you? They already are. Cloudflare intercepts all the traffic going to them despite it being encrypted.
Government might spy on you? They already are. They have backdoors and frontdoors into every system.
Generally? Everyone I accused of being shills off the "everything encrypted" bandwagon. If you want to encrypt your websites go ahead. You don't have to believe my unhinged conspiracies from earlier.
I tend to agree with you on other points but that one is a weird take. If I deliberately visit an https page I want to be reasonably confident that it wasn't tampered with and that I'm not leaking information.
Allowing loading http resources in an https context breaks that trust. Scripts may be tampered with. The website URL is leaked via the referer. Cookies might be leaked.
Note: Mitigations for all those worries do exist. Cookies can be flagged secure-only. Referer can be stopped using CORS, etc. But they all need the developer to be proactive about it and, for the most part, they aren't.