The link in your example - https://www.gmx.com/ - is loading non- secure content from http://themes.googleusercontent.com/
The lock will display only if everything on the page is secure - in this case it's not.
As Safari has no way of knowing if theme.googleusercontent.com is going to be transmitting or receiving content that should be encrypted, then the overall page is in no way secure, and as such Safari won't display the lock icon.
This is correct behaviour - it would be dangerous to users to identify pages as secure when they're clearly not.
Reloading the page above uses cached copies of the fonts, thus no insecure connection is required on the reload. The issue in the link above (GMX) is not a Safari issue, just really bad web development by whomever built the site and mixed secure and insecure content.