The ICE's actually do have a local cache of TV series, movies and audiobooks available through on-board WiFi, it's just not Netfilx but some other network (IIRC Maxdome, but I may be wrong here). Depending on VPN configuration they would even be available while the VPN tunnel is connected.

Furthermore the trains wouldn't have enough space to actually store the complete Netflix repository, so no way to cache that on-board.

The main use of 5GHz WiFi is in apartment and office complexes where each and every single apartment runs its own WiFi and thus the 2.4GHz spectrum is full of conflicting networks, each being encrypted differently and probably even on adjacent channels causing interferences and thus reducing signal quality for everyone. 5GHz doesn't penetrate floors and ceilings and has a generally reduced signal range, thus providing enough spectrum space for everyone.
On a train coach with a single unencrypted WiFi system, this problem simply doesn't exist, so 5GHz would just cost extra in radios, antennas, electronics and power consumption while not every device could use it, so it just isn't there.

And of course they are asking people to secure their connections. Implementing a per-user WiFi encryption costs money in configuration, electronics and power consumption - there are a couple of hundred if not thousand coaches online throughout the day, which is about 19 of 24 hours, if not more, someone has to pay for all of this.
But, regardless of encryption on the WiFi in use, the connection would have to pass the cellular network, which may or may not be encrypted and no passenger-user would be able to actually make sure there is cellular encryption. So why not tell people to do it themselves and properly?
(Okay, OTOH it's interesting how many people are doing business-things on their laptops without even the 3€-precaution of an optical privacy filter...)

Wrt. caching websites - with the proliferation of Let's Encrypt most websites do at least offer a secured connection which in turn means a caching proxy is actually useless because the proxy is unable to actually see the contents to be cached - so no use for that anyway, why spend the money?