So I read the @Umbrel ☂️ product…

So I read the Umbrel ☂️ product is using 'http' instead of 'https' (whilst Start9 uses https by default).

What does this mean for invasive IoT tech in your house (like robot cleaners etc.) with regards to your WiFi security? They could read your unencrypted communication with Umbrel?

Why not use https by default?

I am interested because I am thinking of either buying a device or choose for Linux DIY.