> On native apps, there's no scary warnings
That's not really relevant because the content is delivered the same way to native apps as it is delivered to the browsers as there are huge advantages to using the same tech and the same infrastructure, so it's geared to work well with browsers even in cases where the client is not a browser (this includes things like Rokus, Apple TVs, Chromecasts as well).
> https isn't free. Especially at scale.
Actually, it's a very small premium if you use a CDN's public pricing, but if you're using a CDN's public pricing, you are almost certainly not doing anything at scale. :)
As soon as you're doing an interesting amount of traffic, every CDN out there will happily negotiate better rates with you, and the HTTPS premium is something they are happy to drop, though it's already so small that, for media streaming at least, nobody actually asks for it - the main negotiations are all about the bandwidth pricing (heck, sometimes they'll even drop request pricing altogether - it's just too small to matter to you or them).
If you're not doing media delivery at scale, the HTTPS premium is still tiny. Using Amazon CloudFront's public pricing, for example, an HTTPS request costs $0.00000025 more than HTTP. Given a media chunk duration of, say, 4 seconds, it would take over 4000 hours of streaming for that additional cost to add up to a dollar.