In reply to mark k..

ISPs in developing countries routinely inject ads into plain http web pages i.e. technically a man in the middle attack. So yeah it happens all the time just not where you live.

You mentioned scare tactics above. You should know that google started with the carrot and is only now reaching for the stick.

This whole thing started a few years back when they announced that HTTPS sites would enjoy an advantage in search engine results. This was done to encourage webmasters to make their sites HTTPS.

It worked to a large extent because encrypted traffic on the web went from <20% to over 60%. It is only now that they are employing the stick by warning users about plain http sites.