If the bad actor is injecting malicious javascript over plain text http to the device, doesn’t that get around this? Or is it possible to force the target ios/a

If the bad actor is injecting malicious javascript over plain text http to the device, doesn’t that get around this? Or is it possible to force the target ios/android/etc device to only accept https packets?