it's most likely because someone posted an image that is hosted at an insecure URL.
All DU pages start with https:// which means the page is secure. But on some pages, someone might have linked to an image which is hosted at a URL beginning with http://, or they might have posted embedded social media content that happened to have an insecure image hotlinked within.
The missing "s" means that the URL is not secure. If there is a hotlinked image at an unsecure URL posted on a secure DU page, this is known as "mixed content" -- or more specifically in the case of images, "passive mixed content" -- and depending on your security settings, your browser might throw out a warning.
The bottom line though is that DU pages are all https:// -- if you try visiting http://www.democraticunderground.com you'll see that you are forced to https://www.democraticunderground.com instead -- and our software is designed to disallow the posting of content which could be dangerous -- for example, scripts, stylesheets, and certain types of media. We allow image hotlinking, and we allow social media embeds from a handful of social media apps (which could potentially include a link to an insecure image), but that's it. Things like our Sign In or Account Settings page -- where you may be entering important data such as usernames, passwords, and email addresses -- will never contain mixed content, and so are completely secure.
I'm not sure what happened with your friend, but it sounds like they might have their security settings jacked up pretty high, or perhaps they're running an extension that provides extra protection. I just tried visiting DU in Chrome with no content blockers or other extensions running, and I did not get a warning.
= new reply since forum marked as read