Still places trust in the download servers, which makes them a juicy target

But yes, they could have mentioned HTTPS to make the announcement at least half-assed. Even just saying "good luck not getting exploited" would be an improvement over literally nothing