It's not just for sites which handle user data. MITM attacks are real. Non-tech people don't know what VPN, HTTP or HTTPS are.

Here's an example: a person goes to say Reddit, and clicks on a HTTP link about a new recipe. It's possible for a link to a malicious site being injected in the page. These were pretty common in developing countries.