As I said compression is not the only condition that needs to be met for this attack to work. The browser needs to make requests to other sites, automatically, e.g. via an img src tag.

As for HTTPS, nothing requires me to seek out sites that use HTTPS. Nor to trust sites that use it which I'm forced to use. And nothing requires me to send headers asking for compression support when using HTTP. But with SPDY, everything is compressed, all the time. It's all on by default. This is by design.