First off, just because the url in site settings is http does not mean that’s the site url that’s being used. You can set the url in wp-config.php via WP_SITEURL and WP_HOME. You may have known this already, but I wanted to point it out first.
The constants in wp-config.php can also be set up to be dynamic for different protocols and domains, depending on the request.
In addition, different CDN setups can actually serve a site via https without origin requiring strict adherence to that protocol, for example Cloudflare gives you the option to set an origin SSL certificate.
The implications from my perspective would be if the site serves both http and https traffic, that may lead to a subpar experience and possible mixed requests. Ideally, all traffic would be forced to go through one domain and one protocol. The biggest deterrent for this behavior is from search engines who may see each permutation as a separate site to keep track of and this may result in duplicate content counting against you.
I would check to make sure navigating the site doesn’t result in redirects from http to https, server configuration (and wp-config.php) to see if anything fun is going on there, and the database to ensure all urls point to the same domain and protocol.
Good luck!