Yep in an ideal world it would be HTTPS, but I can think of dozens of sites that require signup/registration that are not. As long as the payment gateway is secure I am generally happy. Appreciate others might be more careful. In 2.5 years of operation however, I never once had anyone complain about my site not being HTTPS.
Think it is probably a little harsh to label them *super amateur* just because of that.