If someone was really hijacking your connection to that http site you’d never know it. They’d redirect you to a website that looks identical and even has SSL, but it’s modified in a subtle way. Like asking you to donate or buy something for example, or maybe login with your Google account, maybe run some malware, sky’s the limit.

The problem with plain http is that they can do this without having to compromise the original website. They just have to be somewhere between you and the website, like a convenient wifi access point.