If you're a network-level attacker it's basically trivial. If you get requests over HTTP of course you should still redirect them, as there's nothing more secu

If you're a network-level attacker it's basically trivial. If you get requests over HTTP of course you should still redirect them, as there's nothing more secure you can do. However via HSTS and even more via HSTS preloading you can prevent them from happening in the first place.