SSL is important but a valid SSL certificate doesn't mean a site is safe.
An invalid (or nonexistent) SSL/TLS certificate doesn't mean a site is illegitimate.
A site without a user facing login really doesn't need SSL. And SSL is pointless on said site if it's for instance a Let's Encrypt.
An example of misleading info (highlighted): https://www.cloudflare.com/learning/ssl/what-is-domain-spoof...
Unfortunately this is not the case. Site security serves not only the purpose of protecting user input, but also ensuring that the data you are receiving has not been altered, ammended or replaced.
At the low level it stops an ISP injecting their own ads or tracking, at the high level it prevents the injection of malicious code downstream from the site itself.
Things like link-replacement, javascript injection, altered text, and so on make even read-only style sites untrustworthy over plain http.
This is not a theoretical issue which could technically become real, it's actually being done.
Depending on the ISP is trust worthy. In this day and age, none is trust worthy. Any network between server and browser can alter the content if it is NOT ssl encrypted. In US it is very often you see Verizon (not to single them out) modify the http content before they deliver to you. I guess it all comes down to if you want to get the actual content that is unmodified by the network routes between you and the server.
That isn't pointless SSL. Let's Encrypt isn't going to protect you from nation states, but cyber criminals aren't going to be invested or necessarily sophisticated enough to get Let's Encrypt's CA keys. Also, if you are worried someone will take over your Let's Encrypt automation and generate new certificates, they probably could use the same RCE to get at your private keys or directly sniff traffic from the compromised system.
If you qualified this statement with "if the business is large cap", everyone would agree but then again that's why BigCo uses traditional CAs or roll their own.
Depends what you mean by need. SSL/TLS still provides benefits like privacy (from third parties) on what you're viewing on the site, as well as no malicious content being injected. It's not just useful to protect your POST requests of username and password.