But the homepage is not served via SSL. I assume the actual purchase form submits through SSL, but an active network attacker could change it to submit anywhere they want, and no one would know.
Everyone makes this mistake, because they think of SSL as being just encryption. It's encryption, but it's also integrity. If a page has security-sensitive functionality at all near it, you want integrity, even if the content is public. (Another example: You have a totally static personal site. Why would that possibly demand SSL? Well, say you want to post your GPG public key so people can send you encrypted email. Someone who can intercept mail bound for you might also be able to MITM your site, so you want SSL to ensure people actually get your real key.)
Just serve everything over SSL always, and you won't have to think about this.