to be fair their API endpoints are https

Sure, but lets encrypt costs nothing and takes one engineer a couple hours to set up, at most. It shows that corners are being cut, which is the opposite of what you want to see in a product like this.

What it shows is that they read this https://www.wix.com/support/html5/article/request-adding-an-... and decided to build their website with that platform anyway.

positively octagonal.

I'd expect something like this to have an EV cert. Just for appearances sake.