The root problem here seems to be that web browsers (and to some extent servers) have become quite insecure in practice due to the insane complexity of all the different protocols they now support. If you are using Mosaic to access ancient web sites the most an attacker can do is to change the content.

Now remote attackers have a simply vast attack surface. They can actually run code on your computer. History has shown such code can never be perfectly sandboxed. So you need to be very sure you are where you think you are and that you are only getting content from that place. TLS is an essential band aid fix.

The same sort of thing comes up anywhere HTML is used. People sometimes claim that email is inherently insecure. In most cases it turns out that html email is inherently insecure.

It seems that any popular protocol eventually gets extended to the point where it is impossible to keep it secure. It also seems that the popularity of the protocol causes a period of denial.