presumably part of the challenge was to do it without using already known information, as he probably already had her email and phone number but still looked for them
If you start on HTTPS and never access plain HTTP resources, it's powerless, otherwise there would be no way to be safe on a public network at all.
sslstrip will still work today on any website that doesn't use HSTS. It will work for the first ever visit (by that browser) of a website that uses HSTS if they aren't on the preload list. A surprising number of websites have neither.
So yes, you can catch a subset of users who type new urls into their address bar, but that's a minority of people a minority of the time.