Good catch. It also has "Your privacy is important to us" and a SSL-like padlock. The web-server at requestinfo.datascience.berkeley.edu doesn't even have a valid certificate (it is return Cloudflare's certificate). So if you were thinking of typing in HTTPS manually then think again...
But as we all know if the form itself is in HTTP then it can be intercepted and modified to send the info to an attacker's own web-server making the fact that they're sending to a HTTPS-enabled server really rather meaningless.
HTTP form to HTTPS essentially breaks HTTPS's MITM protections, it only keeps the encryption somewhat in-place (although with a successful MITM the encryption is effectively disabled).
They do send the form to: https://salesforce.com/servlet/servlet.WebToLead?encoding=UT...
But as we all know if the form itself is in HTTP then it can be intercepted and modified to send the info to an attacker's own web-server making the fact that they're sending to a HTTPS-enabled server really rather meaningless.
HTTP form to HTTPS essentially breaks HTTPS's MITM protections, it only keeps the encryption somewhat in-place (although with a successful MITM the encryption is effectively disabled).