No kidding... this is a problem they created by hiding/obfuscating the URL scheme. If the majority of URLs you visit start with http:// or https://, then data: stands out like the proverbial sore thumb.
security.insecure_connection_icon.enabled
security.insecure_connection_icon.pbmode.enabled
Though it's still disabled by default (currently the insecure connection icon is only shown if a password field is present on a http page / the form action url is http).