True - the purpose was to authenticate, not just encrypt. Years ago, every CA had additional tiers of authentication for certificates that included all sorts of ID checks, corporate records, etc. The idea was that businesses would pay extra for a certificate that guaranteed they were the legitimate brand. However, users couldn't easily differentiate between these levels, so there was no point.

Now people have come to realize a cert basically ties a service to a domain name and that is basically the best you can do in most cases.

This is often cited as the reason (but there are plenty more):

https://en.wikipedia.org/wiki/Man-in-the-middle_attack

If the CA's are doing their jobs...then FirstBank.com can get a cert for their web site. But the gang who rooted a bunch of home routers (or hacked a WiFi setup, or whatever) can't.

If not...then yeah, that's the problem.