When viewing an SSL page with non-SSL content, a message is presented to the user asking if they want to view non-secure content.  If they click "Yes", no product images will show up.  There's probably a more elegant solution to this, but I fixed it by using:

            if (Page.Request.IsSecureConnection)
                pictureUrl = pictureUrl.Replace("http://", "https://");

I put this right before

            return pictureUrl;

in OrderSummary.ascx.cs.  This will cause images to be loaded via HTTP when on the HTTP portion of the site and HTTPS when on the HTTPS portion of the site.