So what’s the problem according to FF?

There’s a ticket in the Firefox bug tracker that appears to be tracking this: https://bugzilla.mozilla.org/show_bug.cgi?id=1913601

Makes sense, because even in reader mode it shows https, and the issue happens on other major sites like Wikipedia.

https://github.com/mozilla-mobile/firefox-ios/pull/16545

Reader mode loads the page from a local copy cached from the non-reader mode connection; via localhost, which doesn’t support https. (or rather, uses a self-signed cert which appears insecure). As this connection is entirely internal to the device, proper https isn’t necessary.

Later versions of the app will hide that icon in reader mode, but it doesn’t look like that’s made it to android yet.