Back in 2013-15 I was fortunate enough to know some people at BoM, specifically done IT people.
Their off hand comment around why BOM didn't have https was due to the amount of overhead and infrastructure changes needed to make that https change.
Fast forward to 2018ish they recently created a new API, and a new website. Https://Weather.bom.gov.au with https enabled! (which I now have integrated into a raspberry pi and an eink display for my morning weather).
For whatever (archaic) reason the new weather webui is now defunct but the api still exists, uses https, and as far as I know supports their mobile applications.
All it would take is for some ISPs here to mitm the traffic with ads / junk and maybe they would change it. The upside to this story is that it is currently a great site to visit for captive portal detection.