Good point. However, the dictionaries also need to be transferred to the user and a MITM could easily replace this with his own (flawed) dictionary. Same point

Good point. However, the dictionaries also need to be transferred to the user and a MITM could easily replace this with his own (flawed) dictionary. Same point: JavaScript injection/modification. HTTPS doesn't guarantee that the dictionary isn't flawed or the JS is secure, but it does guarantee that the received data/scripts/dictionaries are exactly the ones the server intended to send.