I agree with you that SE should be using something protocol-agnostic. As per the answer given by AnnaAdam Lear: (copied only relevant part)
Because HTTPS support is still a work in progress. We're upgrading parts of the code as we go along. For example, user avatars are served over HTTPS now.
We should use protocol-relative URLs more, I agree,
Also from the commentcomments:
All the assets we use will eventually use the appropriate protocol. That's (part of) the plan. :)
So, basically, it's a work-in-progess and that's a good news.