How are they managing the content not specifically served over https? Do the scrap and download it, rewrite urls at their storage and re-serve back over https?
Most browsers will give a mixed-content warning, but still serve images.
Edit: found a reference[0] on the tumblr help site:
>Keep in mind that enabling the option for a theme that wasn’t developed to support SSL may cause “mixed content” errors. If your blog looks weird after you turn SSL on, some resources that the theme needs to render itself may not be getting loaded.
>If you're a theme developer and you'd like to ensure your themes support SSL, make sure that any externally hosted resources such as Cascading Style Sheets (CSS) or Javascript files are served either using HTTPS or a protocol-relative URL. If these files aren’t available over HTTPS, consider uploading them at the Theme Customization page (In your blog settings, click “Edit HTML” and then “Theme assets”).
Does Tumblr actually allow the embedding of arbitrary images? I've never knowingly seen a Tumblr blog embed external ones; they always seem to be Tumblr-hosted.
Edit: found a reference[0] on the tumblr help site:
>Keep in mind that enabling the option for a theme that wasn’t developed to support SSL may cause “mixed content” errors. If your blog looks weird after you turn SSL on, some resources that the theme needs to render itself may not be getting loaded.
>If you're a theme developer and you'd like to ensure your themes support SSL, make sure that any externally hosted resources such as Cascading Style Sheets (CSS) or Javascript files are served either using HTTPS or a protocol-relative URL. If these files aren’t available over HTTPS, consider uploading them at the Theme Customization page (In your blog settings, click “Edit HTML” and then “Theme assets”).
[0]: https://tumblr.zendesk.com/hc/en-us/articles/226273528-Encry...