I have run side-by-side tests with the same site exposed both over http and https from a very performant CDN, and right now Google showed the http site on a sim

I have run side-by-side tests with the same site exposed both over http and https from a very performant CDN, and right now Google showed the http site on a simple search, not https, for example. I don't believe that any penalty is currently significant, nor likely to be soon. There's plenty of good historic sites which SEs don't want to exclude just because someone doesn't have the resources to rework them and keep them maintained with the latest TLS. (Note issues like embedded http resources that would all have to transitively converted to avoid warnings.)