It's still not a requirement. Most modern browser will pester you about it, but it can be circumvented. And it was already a bad idea to publish anything without encryption at the time, and it still is. The issue with SSL/TLS and in general with most encryption scheme (even e2e) is bootstrapping trust, and to my knowledge, there is no perfect way to deal with that. The CA system as its pros and cons and LE at least fixed the biggest flaw for the web (good luck if you need a certificate that can't use an ACME challenge, like most thing non-web tho').
> And it was already a bad idea to publish anything without encryption at the time, and it still is
Why?
Famously, sites like Facebook didn't use or enforce SSL/TLS for a long time, and people were constantly getting session hijacked when using public WiFi. Even if all you publish is static content, encryption still makes your site robust against malicious content injection from e.g. ISPs or malicious access points.
loading story #50441026
It's still not a requirement
It de-facto is. All major browsers will yell at the user saying in more or fewer words that the site is dangerous to view if it’s not connecting over https.