ISP's have been known to inject ads into HTTP pages, and ads are the least malicious thing that could be done by an ISP or wifi hotspot.

HTTP MITM is way too cheap and accessible to pretend you're not vulnerable to it constantly or that you need to be a target, you don't.