Section 5.7 of the same RFC actually lays out the reasoning and security considerations for mandating https.

I'm not sure where "web URI" is defined, but I am pretty sure that a Git URI uses "git://" and Git-via-http is still a "web URI" method.