I think the counter-argument here is that by existing in their current form, these products either are now, or will in the future be, used as part of botstorms,

I think the counter-argument here is that by existing in their current form, these products either are now, or will in the future be, used as part of botstorms, exploited for illegal purposes, etc. I'm sympathetic to your argument, but I've also seen a little tiny "I'm just storing a list of the CDs I own in a text file" apps blow up with multiple gigs of unwanted data, which _probably_ would not have happened with HTTPS. Overall I'm on the side of "there must be some exceptions," but I have to admit that every month it's harder and harder to think of what the legitimate exceptions might actually be, given the toxic nature of the internet.