The logical conclusion of this argument is to disable all links on Twitter, as any domain that resolves to a server running an HTTP server could serve up malware, and that is not the world we want to go to (I say even having left Twitter long before the Elon buyout)
What does HTTP vs HTTPS have to do with malware?
I don’t believe the parent made a distinction between the two. Presumably they used “HTTP” to include both bare HTTP and HTTP-over-TLS?