Well, HTTP has zero security, and HTTPS has this big complicated security mechanism (TLS) that tries to ensure no one can snoop on your connection, alter the content, or pretend to be a server they aren't.
There's no subjectivity at stake, here: One is designed without security, the other is designed with security.
It's like saying the Atacama Desert is widely considered to be drier than a thunderstorm.
The journalist could have simply put "is more secure"—this is objectively true!—but then they got nervous, perhaps because they didn't understand the subject well enough, and decided to fall back to hedge phrases.
The statement is not as good as it can be, because it introduces uncertainty where in reality there is none.