Bonus, the man in the middle can see what packages you’re downloading since you’re not using HTTPS, so they know if you’re vulnerable during an update.

I never understood the insistence on using HTTP as a default for apt. Once HTTPS transport was available and tested (which took forever btw) then it should have become the default. Maybe this will spur some changes.