I don't believe you're accurately quantifying the risk here. Remember, the barrier to pulling off an attack like this is extraordinarily low, and the list of co

I don't believe you're accurately quantifying the risk here. Remember, the barrier to pulling off an attack like this is extraordinarily low, and the list of contexts where it can potentially occur is considerable: potentialy any public wifi network without client isolation, having a naughty neighbor with a yagi antenna and too much free time, ISP/upstream routing entities being shady, or themselves being compromised to serve malware (several ISPs actually performed this exaxt technique to inject ads in the pages their customers were visiting years ago). Recall that my call to action is adding HTTPS support, and you're arguing against that. What's the counterargument against adding HTTPS? I've yet to hear a reasonable justification for not supporting it. It's incredibly easy, it's free, and it takes less than 3 minutes with Let's Encrypt / certbot.