You're right it may not be his fault, but that is why all sites should be https, and sites should have the hsts header set. Essentially if you are using http:/

You're right it may not be his fault, but that is why all sites should be https, and sites should have the hsts header set. Essentially if you are using http:// http:// anywhere on your site (including transitively loaded resources) you are putting your users at risk - the same thing was exploited with the great cannon or whatever that DoS from the Chinese gov was called.