Regarding attacks against the server it is no less secure having port 80 open for HTTP than having port 443 open for HTTPS. If there is a bug at the server side of the provided web application (i.e. SQL injection or similar) it can be exploited no matter if HTTP or HTTPS.
The relevant difference between HTTP and HTTPS is that HTTPS protects the transport of the data between client and server. Properly used the attacker does not get access to the transferred data, cannot modify the data and cannot impersonate the original server even if he can be a man in the middle in the connection between client and server.
To make sure that the client will make use of the protection the server either needs to offer only access to HTTPS (i.e. switch HTTP off) or make sure that the client will access the HTTPS part by using HSTS or by redirecting every HTTP request from the client to HTTPS. If the server provider can be sure that the client will always access the server by HTTPS anyway then HTTP could be switched off completely. Unfortunately for now the default protocol in browsers is still HTTP and thus an attempt to enter the simplified URL (i.e.
example.com instead of
https://example.com) will try to access the site with HTTP and fail with a (usually not user-friendly) error message if HTTP port is switched off. This is the main reason HTTP should be kept active, i.e. to redirect users to HTTPS.