Man-in-the-middle attacks. But equally important, many secure environments won't allow outbound http connections.
In order to meet this guarantee for the scheme you're discussing, the hashes themselves need to have a tamper evident. What is this tamper evident?
I'm not very familiar with how quicklisp works. I thought that “updates once a month” implies a separate update channel (distribution, ...).
Looking at the relevant issue, https://github.com/quicklisp/quicklisp-client/issues/167 , it's not clear that even hashes are in place.
I recently found out that most Nix fetchers use https, but do not actually do verification (`curl --insecure` or equivalent libcurl settings). Channel updates do verify and include hashes, so the overall chain is authenticated.