I am aware of that, but it doesn't prevent an MITM attack. Whenever there are input boxes on a page which is not secured, nothing guarantees you that you are not being a victim of a MITM attack. All form post links could be rewritten to send the data elsewhere. Even worse, page could be running a key-logging JavaScript code, and no-one would have a clue that their passwords have being stolen before they even clicked the submit button.
