These kind of websites rely on having a huge number of domains (for branding purposes) all doing roughly the same thing. In this case basically 'Shop*.ca'. Of course HTTPS can be automated and facilitated with LetsEncrypt, but it would require switching a working system from one way of doing things to another. It's an investment they are not willing to make, because their customers (shops willing to pay for an extended listing on those websites) are shopkeepers, not tech-savvy users asking for improved security.