> But the plugin actually reaches out to its backend servers — dict.youdao.com and dict.cn — over unsecured HTTP.

What year is it?

I assume it must be 2015 at most because my first job in 2008 ran everything, including images, on HTTPS. But I can imagine some last holdpouts 7 years after that.