The short answer is: if SSL is enabled for a domain, stats can only be accessed via HTTPS. If SSL is disabled, statistics is accessible via HTTP.
The detailed answer: since PSA 5.0 release the entire statistics process has been changed. Webstat directory was moved from httpdocs to the domain root, and it is now aliased in apache. The problem with this, is that directories in the domain root are not specific to http or https. So, in theory, these could be accessed by both. However, in order to be able to password protect the webstat directories, they must be defined as either http or https. To facilitate this, we made the alias point to HTTP for all domains without SSL, and point to HTTPS for domains with SSL enabled.