Exactly. Moreover, it's not like there's an immediate cause-and-effect of "use plain HTTP, get owned immediately". Instead, their credit cards and personal info

Exactly. Moreover, it's not like there's an immediate cause-and-effect of "use plain HTTP, get owned immediately". Instead, their credit cards and personal info would hit the black market, get aggregated and sold months down the road. And even when that DID happen, it's not like the fact that their bank account is drained and their identity stolen is immediately determined to be a cause of X transaction on Y date over Z website. In other words, it is hard to connect plain HTTP to identity theft even for the more-savvy let alone the common government worker.