I keep hearing this as a plausible excuse, yet I've never seen any proof of such.
non-https does make it possible but has anyone got any source where someone has been victim of such attacks?
Yes, the most well-known victim was GitHub. A malicious MITM injected JavaScript code into an unrelated non-HTTPS page, making browsers which visited that page do a DDoS attack against GitHub. Quoting https://arstechnica.com/information-technology/2015/04/meet-... "[...] The junk traffic came from computers of everyday people who browsed to websites that use analytics software from Chinese search engine Baidu to track visitor statistics. About one or two percent of the visits from people outside China had malicious code inserted into their traffic that caused their computers to repeatedly load the two targeted GitHub pages. [...]"
Just need to be on the same network as the victim and do some ARP spoofing to make your computer the gateway for that network.
[1]https://www.privateinternetaccess.com/blog/kazakhstan-tries-...
[2]https://security.stackexchange.com/questions/157828/my-isp-b...
As for attacks, others have pointed out examples as well, and I can assure you you can go far with them (and often with some simple social engineering).
HTTP is just a no-no for me as a developer.