I just confirmed this limitation. You have to use HTTPS if you are using that field.
If you do want HTTP support, perhaps you can provide a GCP service configuration directly, instead of relying on the Service Management API to translate your OpenAPI spec to a service configuration? This would workaround the problem, as it would provide ESP directly with HTTP backends.