Since HTTP will no longer be supported, I decided to scan our ArcGIS Online organization for any references. One of my webapps is still referencing an HTTP endpoint even though it was removed months ago.
I created a copy of the app, and then used AGO-Assistant to delete the Json code block. ArcGIS Security Advisor no longer includes the test app when scanning for HTTP. The test app also seems to launch without error, so it seems reasonably safe to make similar updates.
Has anyone else encountered this issue?