They are insecure, because your ISP can change website responses and text format doesn't protect from that. So basically browser can't guarantee that you're looking at original web server response.