There's shenanigans like "grnail.com" pretending to be "gmail.com" which bigger and much more expensive certs prevent against. But the benefit of https that doesn't prevent against this is still very high