Because "rarely" means "they should just ignore them- no malware hoster would ever use HTTPS, especially not if they ever figured out that Microsoft was only checking HTTP URLs". Also, anyone sending log-in information in a GET request is doing it wrong.