> Precisely because they are expensive and difficult to get automatically, they can be a an extra protection against phishing.

And the requirement for an EV certificate is that it has to be registered specifically in the corporate name, which isn't necessarily the well-known trade name. Furthermore, anyone could choose to register their company as, say, "Microsoft" if it's not in the same jurisdiction as the actual Microsoft, and you get this lovely verified checkmark saying that the phishing site is, indeed, Microsoft. (Just not the Microsoft they were expecting).