Well, that's sort of a good news/bad news kind of thing...   The good news is that they don't use SSL, which means we can't be compromised by the heartbleed attack.  The bad news is that no one needs to use the heartbleed attack, our usernames and passwords are already sent unencrypted, "in the clear" so anyone can see them.

It's sort of like saying "at least our door isn't vulnerable to the lock being picked, because our door doesn't actually lock at all."