It doesn't say HTTP is spyware; it says it has some problems (which is true). There are ways to be implemented to mitigate some of these problems.

On VLC’s page it says not spyware in green and then says it has some opt-in spyware features.

It’s also interesting that Steam is listed as extremely high spyware level.

Honestly, Steam probably isn't even that bad compared to the games themselves with the kernel space DRM.

The front page sez:

“We take an expansive and strict stance on what constitutes spyware. We define spyware as anything that includes telemetry, phoning home, automatic updates or is listening in without the user's knowledge or consent.”