It's incredibly embarrassing if they're not using any kind of encryption for this.
I'm glad you mention TLS certificate, because those are an ongoing thing, not something you set up once leave unchanged for 40 years.
You know what comes after a warning.