Lock symbols and HTTPS security are only needed on pages that deal with the transmission of sensitive information such as the login page - which has these.
Sites do not need these on every page.
In fact it's bad practice for them to have as it means that web traffic that does not need security is encrypted unnecessarily and is slower etc.
So the site is secure where it needs to be.
Hope this helps.
