HTTPS claims to secure the connection, so it is necessary to make clear when these claims aren't justified.

HTTP makes no security claims, no there's no "unexpected lack of security" to disclose.