I would speculate that it's inertia due to decisions made a decade or two ago, before we decided that everything should run via HTTPS.