They are insecure, because your ISP can change website responses and text format doesn't protect from that. So basically browser can't guarantee that you're looking at original web server response.
The format being text, html, video, or an executable program has nothing to do with it.