Currently, even when the "Show Full URLs" option is enabled in Orion on mobile, the protocol is hidden. Which is to say: if I navigate to http://example.com,the address bar will display example.com. If I navigate to https://example.com, the address bar will still display example.com. This is important information that's being hidden! There are good reasons to avoid typing in passwords, for example, on non-HTTPS sites.
As things stand, the only way to check is to tap on the address bar; the protocol will properly appear at that point, even if it doesn't appear in the resting view. But this is an awkward workaround, and really shouldn't be necessary.
So I suggest modifying the address bar preview so that—at minimum for anyone who has "Show Full URLs" enabled in settings, if not for everyone else, since people with that setting enabled have pretty unambiguously opted into verbose URL readouts—it displays the protocol there directly. Make it so that the address bar preview after navigating to http://example.com is http://example.com, and the address bar preview after navigating to https://example.com is https://example.com, rather than both collapsing down into preview text of example.com and leaving the security status of the site unclear.