Historical reasons I believe and also because packages are signed. Though there’s been a few vulnerabilities that have made TLS (IMHO) a necessity. As well as just preventing snooping. Modern debian and apt should support TLS out of the box now.

Unlikely to be the problem, but I’d switch the config to use https URLs.

If schools only focused on what students were motivated to learn, I’m not sure schools would really be accomplishing much. Not to say that schools shouldn’t foster motivation in students. Just that technology, especially social media, is very effective at distracting people.