This is addressed in the article.

> If you exclude navigations to private sites, then the distribution becomes much tighter across platforms. In particular, Linux jumps from 84% HTTPS to nearly 97% HTTPS when limiting the analysis to public sites only.

Sounds like it's just because a large chunk of Linux usage is for web interfaces on the local machine or network, rather than everyday web browsing.

Speculation, but: there are probably quite a few Linux systems displaying internal dashboards over HTTP, with the page set to auto-refresh.