I read the article, and I don't think we should take action on this specific issue.

The author suggests adding Yet More Security States, which we know from studies doesn't make users more secure.  I think the right long-term solution here is the work to badge non-HTTPS pages as insecure; it's just that that will take a while.

In the meantime, I don't think this is significantly different than putting "accounts.google.com" in some other part of your URL.  We can't stop someone from serving up http://data.text.html.com/accounts.google.com/phish.html, for example.

The data URL presented is already fairly uninviting, and it seems unlikely that making it more uninviting is going to make a meaningful difference in some way.  But, willing to reopen if a security person strongly disagrees.