I would have assumed a beach head where they compromised a system on the internal network and then phished to extend the reach.

I figured IT of all people would have allocated some DNS and some certificate. I would have taken the lack of TLS and DNS as a consequence of an attacker not having enough access to make those things a reality, and banking on people viewing 10. as safely internal like you are inclined to suggest.

Just because it has an internal address does not mean it is safe, particularly as number of employees goes up and any one of them can get a system under their control compromised.

is it tho? that's a LAN IP, so just a file on the company's network. browsers whine about http by default bc its security over WAN. then windows just whines about everything

It's the latter. They actually get thrown all sorts of money in part because they say they need tools. The standard corporate load has at least 3 patch management software suites, two 'cybersecurity monitoring solutions', three anti-malware software products.

Sometimes their automation fails and this was one of those situations where his and at least in our department only his where their automation failed for some reason or another. So they fall back to a sketchy looking exe on some random web server they don't even bother to enable https on (they also provision root CAs, so it's not like it would be a challenge for them to have https on an internal domain).

They aren't very good, but they are doing things perfectly right; so long as the one deciding what is right is the sales reps of the software they use.