Because anyone who controls any system on the network path between -- or your DNS -- can read, or more importantly ALTER the content. This includes javascript malware, redirecting links to phishing sites, etc. It's honestly disrespectful to your site visitors not to provide TLS.