My thoughts on this point:
- Any user with a browser that has your site on the preload list is safe.
- Any user who has previously visited your site and received the HSTS header is safe.
- If someone's visiting your site using a browser that doesn't have a HSTS preload list (or doesn't support HSTS at all), and explicitly requests
http://example.com, the information leak has already happened, independent of whether you listen on port 80 or not. In order to read that traffic, an attacker needs to be in a position to MitM a connection anyway - and if the attacker is in that position, he can easily listen on port 80 instead of you.
I don't see any additional risks in doing this, and it's a huge UX win for any users who accidentally visit the http:// version (who would otherwise think the site is down).