&gt;  Any random ISP, open wifi, or other entity could trivially MITM a popular site via HTTP and obtain privileges...<p>If a user is MITM&#x27;ed, it doesn&#x27;t matter if some features are disabled. The attackers can do anything they damn well please, like directing the user to a compromised HTTPS site to access those features, or to a drive by download to do worse things.