Luckily browsers are nowadays shifting towards making the initial request via HTTPS. Chrome, for example, has been using HTTPS when typing an address into the address bar without specifying http:// explicitly [1].

[1]: https://blog.chromium.org/2021/03/a-safer-default-for-naviga...