The point of encrypting something that gets decrypted midway by an organization is that there are worse actors than the organization out there. I’m not really scared of Steam abusing my credit card info, but I am afraid of random internet strangers.

Also remember that https doesn’t just protect your data, it also verifies that you’re actually on the website you think you are. The internet is basically unusable without this guarantee, especially on a network you share with others.