Why tie compression and security?

What is so wrong allowing plain http to use compression like brotli?

I'm serving gzip content without issue, I see no difference on why brotli is treated any differently. What was the reasoning?

Background; I'm all for promoting https (I use it via Cloudflare), but https can be more taxing on the cpu in my case. So I use plain http instead.