Curious, does this still apply if http is used exclusively?

Well no, in that case all traffic is exposed anyway.