Am I missing something? Is the documentation buried somewhere? The best I could find was a forum post http://www.ubercart.org/forum/support/1850/ssl_which_paths_do_you_protect
Probably because it's not a part of Ubercart itself -- people who need SSL use the Secure Pages module: http://drupal.org/project/securepages
You're right though, this is something that is lacking in the UC documentation. Securing a site for ecommerce is a bit different than your average social site, and there are some paths you should be aware of that need securing.
I've added a Book page here: http://www.ubercart.org/docs/user/15055/securing_your_site
Feel free to edit it. I don't have a "definitive" list of paths to protect because it varies based on what payments you have enabled, what modules require secure callback paths, etc., but it's a good place to start.