First two results are:
facebook.com/mybank
facbeook.com/mm48283df884
Which is the "real one" based just off this information? How do you know that when you message one of them you're getting the actual bank and not a fraudster?
It's not just vanity, people do check these things, not all of them savvy enough to continue researching. Just peek at "safe browsing tips" you'll see from tech rags online and it's pretty clear we do a poor job of educating people about proper vetting online, so you get people instilled with dogmatic understandings of security. ("The URL clearly says Mybank, so it's the real one." "Google actively removes fraudulent websites from the top hit, so it must be the real one", etc)
It sucks, but it is important to try to control for such errors.
They are shown in the address bar of your profile page once set.
Actual usernames typically do all of the above.