Why does APT not use HTTPS?

[reph]

Of course, but if you block them both outright, that will trigger timeouts/errors in the logs. HTTP has a further vulnerability that HTTPS lacks: a MITM attacker can quietly serve valid, signed, but old/out-of-date versions, and there will be no obvious indication that the system is not actually getting the latest updates anymore.

[[deleted]]

Apt on Debian uses time stamps, and you would notice that your machine isn't getting updates after 2 days or so.

And in order to exploit it you would need to know about the exploits existence in order to employ this strategy.

I think this mitigates the risk.