A more general problem is that A LOT of Windows software is actually released on non-HTTPS-only sites, so that any given Windows installation is highly likely t

A more general problem is that A LOT of Windows software is actually released on non-HTTPS-only sites, so that any given Windows installation is highly likely to eventually run an executable downloaded via non-HTTPS download. All the NSA has to do against random Windows users is wait until an HTTP request for a .exe file comes and automatically infect the downloaded executable.