In short, there is security without HTTPS, because all the packages are cryptographically signed and APT verifies the signatures.
The APT system is a secure packaging solution in which packages are signed with keys known only to Ubuntu and APT verifies the signatures against the package using public keys in APT's keyring on your system. This effectively provides end to end assurance that the package is unmodified by anyone outside of Ubuntu regardless of whether you obtained it from an official Ubuntu server or some mirror somewhere.
Ubuntu's repository system was built (as part of Debian) in a way so you don't have to trust the mirror you use, just that they didn't modify the package since it was signed internally by the distribution. This allows for the repository to be decentralized and for any volunteer to set up a mirror.
So, for example, you could use example.com as a mirror - if you were to use HTTPS and verify that you really are talking to example.com, it doesn't tell you anything useful, such as whether that mirror is approved by your distribution (Ubuntu) or whether that mirror modifies the packages after it gets them from Ubuntu to add viruses, it just tells you that you're talking to example.com. But APT's built in signature verification does provide those assurances.
A technical explanation of how this works is available from Ubuntu (and from Debian which uses the same system).
APT does work over HTTPS and you can use HTTPS in an APT sources entry to apply another level of assurance to your connection (if the repository you're using supports it). This can act as an additional safeguard on top of APT's, especially now that past concerns about additional overhead imposed by HTTPS connections are less relevant.
Arguments for using HTTPS:
Not using HTTPS can be a privacy concern, because eavesdroppers could see what files you are downloading, though privacy has not historically been considered to be concern in this case as they are publicly available files, and APT's verification can still detect modification. Nonetheless HTTPS could be used to make it harder for attackers to see what you are installing.
Another assurance that APT's signing mechanism doesn't provide is that the packages you are receiving are the latest available version. As a mitigation to this, the signed release file includes a "Valid-Until" date field after which the files it references should be considered out of date. It would be plausible for a man-in-the-middle or nefarious mirror to substitute an archive with an unmodified earlier version of the archive within this Valid-Until date and delay an update to a package for this time window. But they can't make any arbitrary modifications to packages nor could they go back in time past that point.
Another reason you may consider using HTTPS is to guard against flaws in APT's own signing and verification. Flaws in this have been discovered, and fixed, in the past.