There is actually no difference between these from the perspective of the browser and HTTP protocol. A URL consists (among others) of a protocol (
http://), a hostname (
www.example.com) and a path. An empty path is not possible and both of the URL shown use the path
/. So there is no actual redirect between these URL since these are equivalent already.
For more on this see the HTTP standard, specifically RFC 7321 section 5.3.1: "If the target URI's path component is empty, the client MUST send "/" as the path within the origin-form of request-target.".
Note that this only applies to
http://example.com/, i.e. empty path vs.
/. With a path of
/foo/ it is different since these will actually result in different requests.
Moreover, user final destination is HTTPS so my thinking is it should be secure enough.
Since the initial request and response are still done via plain HTTP, they are not protected against manipulation by a man in the middle. For example the response could be modified or a new response injected to direct the client to a different final URL. This actually happens, see for example Internet Provider Redirects Users in Turkey to Spyware: Report.
In other words: every clear text redirect is one too much. To reduce this attack vector further use HSTS.