Because even with HTTPS that script might not do what you expect and then is too late, xz style attack.