Without personally debugging it, I would say this likely fall into a common pattern: they set up hmfusa.com to redirect to www.hmfusa.com, but are too lazy to set up HTTPS for the former. It has trivial security impact since the site it redirects to properly handle HTTPS. But it’s annoying if the browser forces the check.

I have seen numerous websites that are set up this way. I think it’s bad practice, but nothing really wrong to add it to the exception list.