This question already has an answer here:
Why do untrusted/expired SSL certificates get such a huge warning in modern browsers even with "DO NOT VISIT THIS SITE!" messages, whereas a regular HTTP connection, which is more prone to eavesdropping and MITM attacks, doesn't get even a single comparably visible warning? A lock versus a world in a tiny icon is certainly not comparable to huge don't enter here signs.
What's the threat model where huge warnings for untrusted SSL certificates and no warnings (or very small warnings) for plain HTTP are sound?