[immibis]

It does. I don't think this example is as good as you think, though. You used to have to give out your full legal name and address and have them verified to get an SSL certificate and the lock icon. When any random website could get the lock icon, this did indeed lead to more people typing their passwords into phishing sites, thinking they were real because they had the lock icon, and this was indeed a real problem.

They could have chosen to only show the lock for EV certificates, and show something else, or no icon, for DV certificates, but instead they made a choice that was misleading. Google probably should have been fined for that, but not very much, because it wasn't foreseen. I think Mozilla was still a non-profit at the time.