> And how prevalent is the practice of ISPs injecting packets into non-HTTPS traffic?

Is there anything preventing page alteration on unencrypted connections? There's certainly an incentive to do so.