You are right, by itself it doesn't matter. All Heroku users should be smart enough to figure this out themselves. However, Heroku should also be smart enough

You are right, by itself it doesn't matter. All Heroku users should be smart enough to figure this out themselves. However, Heroku should also be smart enough to figure out that all links should be https and servers should have valid certificates. For a company to make such basic security-related mistakes while in the middle of a bad security incident doesn't look good, to put it politely. It sort of explains how they got where they are.