It's unclear from the message what is "the website" especially if the feature is being used from an iframe:
"The deviceorientation event is deprecated on insecure origins, and support will be removed in the future. You should consider switching your application to a secure origin, such as HTTPS. See https://goo.gl/rStTGz for more details."

Should this be more generic? or at least the documentation should mention that the parent chain is being checked so it could happen because there is an insecure iframe instide a secure top frame or the opposite?