The threat model of plain http is about the user (and injected content) and not the server. Plain http is a threat to users.

Has it really been so many years since people used to do tcp injections and walk around coffee shops or whatever returning results faster than the internet server and injecting goatse?

You guys have forgotten who tls protects.