I know we can redirect but this still sounds like a bug. there wasn't a "hey, if a site has http AND https, let's choose https regardless of other signals" algorithm change that went live, was there?
For http/https .. another thing you could do for canonicalization is to make sure that internal links use absolute URLs, or to crawl your website to make sure that you're at least consistently linking. Usually when this kind of thing happens, there's at least some small inconsistency that you've overlooked. There's no magic https-pushover, but over the course of the year, I'm sure users are going to be pushing for more https on their own.