Famously, sites like Facebook didn't use or enforce SSL/TLS for a long time, and people were constantly getting session hijacked when using public WiFi. Even if all you publish is static content, encryption still makes your site robust against malicious content injection from e.g. ISPs or malicious access points.

Because anyone who controls any system on the network path between -- or your DNS -- can read, or more importantly ALTER the content. This includes javascript malware, redirecting links to phishing sites, etc. It's honestly disrespectful to your site visitors not to provide TLS.