Starting API 28[1] and iOS 9[2], insecure connections are banned on native platform by default. Flutter, on the other hand, uses Dart VM's HTTP implementation which integrates with Sockets directly. This circumvents the security features on the platform and allows HTTP protocol.

We recently added capability to disallow HTTP on a per-platform basis to Dart SDK (dart-lang/sdk#40548). This issue tracks enabling that feature on iOS and Android platforms only. Desktop and Web platforms are unaffected.

1: https://developer.android.com/training/articles/security-config#CleartextTrafficPermitted
2: https://developer.apple.com/documentation/bundleresources/information_property_list/nsapptransportsecurity