The reality is that majority of websites are outdated with legacy technologies, vulnerable, too complicated, over-combined. From governments, big corporations, banks to hobbyist websites ...

All of these sits on the outdated hosting environments with rusted machines from the time our grandmas were young ;)
Similar to this is the user experience. On one site I can't change the email, on another the username or can't simply delete my account bc. this and that ... "excuse".

Even WPTavern does not use SSL. It is a 5 minutes job today on a modern hosting environment. Your contact form is safe the same way how it looks.