This issue is two-fold right. You can install plugins that force SSL client side (on the main site and any AJAX calls thereafter) but like you said you have no idea what calls that site is making server side. They could be sending everything you send them over plaintext after the initial TLS secured request. Rough times.
But it's very difficult to ensure that all the communications your device is making (background services, vendor apps...) go through that channel.