The article is from 2011. Certs were expensive back then. People thought TLS was an unnecessary hassle, difficult to configure etc. There was an idea that you j

The article is from 2011. Certs were expensive back then. People thought TLS was an unnecessary hassle, difficult to configure etc. There was an idea that you just do the really important parts (logins, authorizing fund transfers) over TLS and do the mundane stuff offer HTTP. (Static site assets) XSS was so rampant they gave it its own acronym. The natural extension of that was to do everything over HTTP and for the handful of objects that need to be secured, you just encrypt those ~100 bytes of important data. Then let's encrypt happened and all that went out the window.