Everything being encapsulated in HTTPS is the result of waiting so long to be secure by default that the base network abstractions had ossified too much to realistically change.

TLS would have made sense as well but if you're already at that point you might as well bump up yet another abstraction layer because the programming ecosystem is bigger and it frees you from being tied to one security abstraction forever e.g. now you can use QUIC.