ArchLinux's package servers are http by default and include no https servers by default. We're a long way from disabling http. It's "not a problem" because packages are signed, but it's still http.