This onion site (like most) are not accessible over https. Since Tor hidden services are encrypted end-to-end, there's no need for it aside from identity validation that SSL might provide. If you access it without https it works fine and your traffic to and from the site are encrypted between your computer and the site.
The end-to-end authenticated encryption properties of .onion addresses are applied after browser sends the data out, it has no way to know that it is sending the data to a local tor instance and that it will be implicitly encrypted between you and the onion.
As such it thinks it's "insecure" because it doesn't need https to defeat eavesdroppers.