Why dont schools protect their student information system (SIS) with HTTP strict transport security (HSTS)

this starts with a story about how my school does things:

I found this out very recently, on our schools student information system you can connect though port 80, completely unencrypted with no warning. I keep getting excuses from administration to add HSTS into the student information system, such as "yeah it wont happen to us" or "the worst thing happening would be advertisers", and the worst part about this, is the breach to canvas happened a few days after I contacted them to DO THIS!

I dont know how someone could be THAT IGNORANT about simple web security, and be given system administration privilege by the district. so that left some questions:

WHY where they just, ignoring simple security advice, used on most servers including for sites like youtube or facebook, and why wont they just ADD HSTS into their server security policy, its not difficult and could save you from downgrade attacks in addition to simple encryption of the database drives with AES-256 and secure their endpoints with some honeypot databases to deter other means of hacking?