A redirect has its security gotchas as well: if you usually rely on redirects to reach HTTPS sites, you are just as prone to get redirected to a malicious site

A redirect has its security gotchas as well: if you usually rely on redirects to reach HTTPS sites, you are just as prone to get redirected to a malicious site using MITM attacks (eg. while on a cafe wifi). If there was a redirect, you could easily be MITM-redirected to eg. https://blog.bozh0.net https://blog.bozh0.net and you might not even notice. Browsers are finally starting to default to HTTPS without using a whitelist when no protocol is specified. That's the only reasonable approach, and hopefully in a few years, that's prevalent. Maybe browsers can also start doing something "smart" where they also fetch https resource when http is requested, and switch to https if they largely match. Combining it with secure DNS is the only way to true protection against eavesdropping and MITM attacks.