People often don't think about the transition from a "public" page to a "private" page. Take Hacker News for example. If you go to the home page without loggin

People often don't think about the transition from a "public" page to a "private" page. Take Hacker News for example. If you go to the home page without logging in, you'll see a list of posts. Does this need HTTPS? Using your logic, it wouldn't. But there's a login link in the top right corner of the page. If someone were to MITM the home page, they could make this login link go elsewhere, and harvest data. The same is true of any site which has links to login/signup/payments/contact forms etc. That describes virtually every site these days. It's much easier to have every part of the site on HTTPS, than to have to worry about this. Plus you avoid the possibility of malicious ads, scripts, and malware being injected into the page.