I think that's the point---they should assume the worst. It's part of a general trend of moving the needle from "Internet services are insecure and if you real

I think that's the point---they should assume the worst. It's part of a general trend of moving the needle from "Internet services are insecure and if you really want to send something secure, you should be sure your channel is encrypted" to "These channels should always be secure; if they're not, here's a big red flag to warn you that they are not." See also the process of bypassing the "This site is insecure" alarm interstitials in Chrome and Firefox these days for sites with bad secure TLS credentials. The frog has been boiling from "We warn the user with a tiny icon they'll probably ignore" to "Users have to know secret words or convoluted config flows to bypass this inescapable error panel."