http - ISP injects sales/billing garbage in the response. Completely insecure! phone - I dial the number my bank gave me and no man in the middle ever answers

http - ISP injects sales/billing garbage in the response. Completely insecure! phone - I dial the number my bank gave me and no man in the middle ever answers or interrupts. But still completely insecure! Now imagine you see me trying to enter my credentials over an http connection to AwfulBank.com. "Stop! That's completely insecure!" you say. "Sure, but so is calling a bank using the phone number they gave me." If both cases are already completely insecure, why am I wrong?