All these "you"s are the person sending the payments request, are they not?
Yes, but if you're going to make the argument that you're being harmed by bitcoin-qt not restricting the freedom of others (an argument I've used here and there at times) I don't think it applies here.
The payment protocol doesn't provide its own secure channel. Thats not what x.509 for is used for in the payment protocol. The use of x.509 in the payment protocol is for non-repudiation (which many secure communications channels don't provide, including SSL). Without a secure communications channel your privacy/security is hosed, and with one your usage of the payment protocol is secure from privacy or theft attacks even if the x.509 certs aren't secure.
In particular: It's primarily the sender the payment request which cares about the integrity of non-repudiation since if their non-repudiation is compromised customers will be able to convince others that the sender ripped them off.
If someone were making an argument about non-repudiation there might be something to discuss here, but no one appears to be talking about it.