HTTP can be used not only for spying on you, but for attacking you with malware as well (or even something as "innocent" as being injected with the ISP's own ads):

https://citizenlab.org/2014/08/cat-video-and-the-death-of-cl...