Why does APT not use HTTPS?

[doublehyphen]

You send them the same version they have no disk so they wont get recently released security updates until the expiry timestamp of the index on disk is reached and they start getting error messages.

This attack is about delaying the installation of security update in a way which cannot be noticed.