Although the website is a mirror of the company and there are fewer companies that don’t have one, many companies still do not take care of their security. The domain used by the website is the same domain used by the company’s email address.
Website security via HTTPS certificate is negligible annual cost if you consider the potential damage that a company can experience due to a couple of tens of euros cost: financial, legal, reputational, etc.
HTTPS as we have known it until now is clearly no longer a sufficient protection system, and even Google had to intervene.
More about these changes you can read in the National CERT article.
