That's not the main issue I see with serving unencrypted HTTP. The bigger issue is that it's a vector attackers can use to deliver malware, as the entire response can be hijacked.