Comment by huuuz

In that case the html text of the page could be replaced by the attacker so the download link points to an https link.