Https doesn't help with this if the MitM is the apt mirror you are using.

One reason http is still used is because you need an independent signature anyway since it is common to use mirrors that don't have the same level of trust as the debian maintainers