Most phishers probably aren't going to have $50-100k spare either.
I think there has been a great misunderstanding with this scheme due to how its been reported by the likes of BBC News - applicants will have to submit business plans and demonstrate a technical capacity to maintain DNS servers - I bet they will have some pretty strict requirements by the time it's finalised, and I'm sure they will heavily scrutinise all applications.
It's not like any old Joe can just set up their own TLD overnight.