Back when http was more popular my mobile provider injected popups with ads on every http page like nobodies business. And I couldn't switch to another, they all did that.

This isn't about theoretical MITM attack, it used to be widespread.

And there isn't any reason why it wouldn't spread again if http got more popular