One way to look at the problem is the following: why would you not want to use SSL ? The overhead is slight, and the price of the certificate is inconsequential for a business. Maybe, instead of searching for reasons to use SSL, we should apply it unless there is a known, explicit reason why we should not.
Anyway, for your specific situation and with the attacker's point of view: a non-SSL Web site is "safe" as long as the protected payment portal includes an explicit description of what the customer is buying. The customer must see, through the SSL Web page, an unambiguous description of what he is paying for. A simple opaque contract reference is not enough, because the customer cannot really know, then, that what he saw over non-SSL Web page is really what the server sent from the other side.
On a general basis, active attackers can spread considerable mayhem on an unprotected Web site: defacement, automatic download of malware into unsuspecting customers' computers,... but this crude vandalism is often detected as such. A much more damaging action would be to only insert subtle alterations in the Web site functioning. If the customer buys a package and discovers only upon landing in a remote sunny island that, contrary to what he thought, his package did not include the hotel booking, then he will be quite irate; and a subtle attacker can make that unhappy situation happen by altering the non-SSL contents of the Web site. If I wanted to thoroughly crush the business of the holiday-selling Web site of your client, I would do it that way.
Most Web sites avoid attacks by sheer mass effect: there are just not enough attackers around the World to really break all vulnerable sites. That's a rather effective, but heuristic in nature, security protection. Using site-wide SSL is a not very expensive way to lower the dependency on luck.