I'm logged in to security.stackexchange and I'm not using https to browse the site.
Does this mean that the site is vulnerable to session hijacking? I assume that it's not, but I don't get how session is protected if connection is not secure.
The session cookies (or at least, what looks like session cookies to me)
This does not protect against at attacker who can intercept your traffic, but in that case, it is possible to access the site with HTTPS enabled - just go to https://security.stackexchange.com
I don't know why it doesn't default to the secure version, but there is relatively little sensitive data being transferred after the initial sign in (almost everything is publicly available, after all), so it may be that the cache advantages of not encrypting outweigh the security benefits.
Yes, it is vulnerable. Anyone can grab your session cookie.
Why? Ignorance and denial as far as I can tell. Very slowly StackExchange developers have been moving towards enabling https, but after a short spurt of development it seems to have stopped again. I still don't use this site on higher-than-average risk networks (public wifi; security conferences), or I turn on VPN first if I really want to use this site. StackExchange is the only site I frequent that does not support https.
If you type https in the address bar manually, it seems to accept that now. I hadn't noticed this yet, in the past it'd redirect you back to insecure http unless you were on the login page, and right now it still has mixed content issues. Ugh. It really isn't that difficult.
Typing https manually works if you're logged in (if not, after logging in it will kick you back to http so there goes your session, no matter what you do), but the DNS lookups reveal which site you're using and someone could easily inject a request in your browser (when you use, say, a news website over plain http) to the insecure version to grab your session cookie.
TL;DR: ignorance from the developers regarding session cookies over http. I guess they're waiting for a high-profile case to happen. I've had this happen around 2009 on a different site to my admin account, so that was the lesson for me.
Session hijacking is not related to HTTPS/SSL directly. SSL prevents the transmitted data from being altered, which cloud be a session among many things. Often sessions are bound to an network address so they are only accepted by the backend on specific connections.
If you ask why the boards are not tunneled securely by default then post a similar question on meta.