A valuable target will always get hacked because they'll be specifically targeted. For most of them it'll be from spearphishing, but there's a multitude of ways to attack people even if https is the default.

Yes there are other vulnerabilities, but that's not a reason to fail protect against this one (taking that reasoning to an extreme, all security is pointless because there always are other vulnerabilities). The purpose of security is to increase the cost of a successful attack; https has a high ROI in many cases. In the example you give, spear-phishing is much more expensive than sniffing wifi.