The initial request/redirect response is insecure. So a MITM can intercept the redirect response and replace it with his own content. That content could be, for

The initial request/redirect response is insecure. So a MITM can intercept the redirect response and replace it with his own content. That content could be, for example, a 200 response status and HTML pulled from the attacker's HTTPS connection to the target site. So rather than being redirected to a secure connection, I happily communicate with the attacker instead.