Putting aside the whole issue of delegating trust via certificates, the simpler answer is that encryption is hard, and thereby expensive. For many purposes, both service provider and client continue to consider it an unnecessary expense.
Only recently, with the spread of wireless networks, has the threat of en masse MITM and eavesdropping attacks become realistic. For a long time, it took serious knowledge to pull these things off on a wired LAN or within the walls of an ISP.
You could say the same about phone calls--why isn't the POTS network encrypted?--but that's because it's well constrained within wires run by trusted people and such cost is not justifiable; but with the advent of cell phones, protocols like GSM had encryption built into them, since telcos couldn't ignore that data sent over the air is readily captured and manipulated.
Only recently, with the spread of wireless networks, has the threat of en masse MITM and eavesdropping attacks become realistic. For a long time, it took serious knowledge to pull these things off on a wired LAN or within the walls of an ISP.
You could say the same about phone calls--why isn't the POTS network encrypted?--but that's because it's well constrained within wires run by trusted people and such cost is not justifiable; but with the advent of cell phones, protocols like GSM had encryption built into them, since telcos couldn't ignore that data sent over the air is readily captured and manipulated.