... because https only protects the payload in flight, not at rest, and not the origin and destination ip. It depends on your threat model.
Please don’t come back and tell me “oh but you can use a vpn”. We have yet to build a real vpn that can stand up to serious scrutiny.
Edit: to be clear, we might be able to build routers that actually are blind routing oracles, but we haven’t done that yet.