This is addressed in the article.
> If you exclude navigations to private sites, then the distribution becomes much tighter across platforms. In particular, Linux jumps from 84% HTTPS to nearly 97% HTTPS when limiting the analysis to public sites only.
Sounds like it's just because a large chunk of Linux usage is for web interfaces on the local machine or network, rather than everyday web browsing.
Speculation, but: there are probably quite a few Linux systems displaying internal dashboards over HTTP, with the page set to auto-refresh.