My assumption from that sentence is that both "ad malware" and "ad tracking" are injected by some ISPs somewhere between the client and the server. By forcing H

My assumption from that sentence is that both "ad malware" and "ad tracking" are injected by some ISPs somewhere between the client and the server. By forcing HTTPS, you'd prevent some amount of this by ensuring the data in transit from client-to-server-to-client is encrypted (and thus mostly tamper-proof) using the .dev domain's public cert.