It is because some shady sites were putting a lock icon as the favicon to make you think it was secured so the tab is the better place for them.

One reason may be tabnapping. The risk was described by Aza Raskin while he was at Mozilla.

http://www.azarask.in/blog/post/a-new-type-of-phishing-attac...

They still have it in the tab. Don't worry - the favicon won't disappear!