That is true, but that doesn't protect you from the server being hacked and the script replaced by a malicious one.

If you execute unsigned code from a 3rd party without sandboxing, transport encrytion doesn't help you much.