If we do an apt update or apt-get update it uses http for fetching updates. We can change the source to secure https by editing the url of sources.list /etc/apt/sources.list but most cases this doesn't work. Why doesn't ubuntu force https for apt update?
Only thing you gain is the secrecy about what kind of software you're installing.
One of the reasons why https is annoying are the corporate firewalls that want to decrypt https. You have to deal with their certificates, slowness and bugs.
So it's easier to stick with http and apt's built-in GPG for origin and integrity checks. Especially when the "what software you're installing" is seen anyway if you're using lots of products that have their own repositories. Probably need to Tor it if you want to hide the fact that you've accessed the google-chrome repo, docker repo, etc.