Take for example this major Swedish newspaper, Dagens Nyheter (literally Today's News). Their web page is available over HTTPS at
https://www.dn.se/ and, in Firefox, shows as "secure connection" using the TLS 1.2 cipher suite
TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256 when I tried it just now.
They also offer a RSS news feed at
https://www.dn.se/nyheter/rss. When I browse to that URL with the exact same browser, it shows as "not secure", and Firefox reports "connection not encrypted" in the page information security tab.
How is this even possible? It's the same protocol (HTTPS), same host name (
www.dn.se), same port (default 443), same (presumably!) certificate validation going on in the browser. The path portion of the URL isn't transmitted until after the TLS session has been set up. How can different paths on the same publicly-visible host name consistently result in different levels of TLS security like this?