But there is one big gaping security hole: If your project page is served over plain HTTP, and people click on the download link, they are vulnerable to a man-in-the-middle attack. An attacker could change the link to point to a malicious binary instead.
The only way to prevent this is to make sure that your customers don't access your website over HTTP. And this is why HTTPS support for Github pages is important.
As many other has noted, even when once in the future you'll be able to rely on free certificates from Let's Encrypt, serving millions of sites with different certificates (that needs to be replaced every 90 days) adds lots of complexity to any CDN based infrastructure and cost real money.
Apart from that, if you do just SNI based SSL you have to add support costs for explaining to people that don't know the implications, why things like some automation tools, old Android browsers, IE on Windows XP, etc, breaks.
And if you do full SSL you need to allocate lots of IP addresses at each CDN PoP which is expensive.
The certificate is just a small part of the equation when you're offering CDN based SSL.
Thats another service you have to monitor to see if its continuing, another service to be hacked, another account user/pass to have.
However, I prefer to use GitHub so that I have all of it in one place, including the website, and I don't have to spend time managing the infrastructure.