Chrome happily displays the subdomain for secure.bank.chase.com-url.io, it would only hide it for www.com-url.io. No phishing prevented.

I'm curious, can you think of a good reason to hide only www?