I was going to say something precisely to this effect, but you already hit the nail on the head. Given enough time, the odds of something like that happen will approach 1; and, suspecting how people that create frauds work, this won't take long to happen, either.

Looks like it's going to become more important than ever to not only check for the " https:// " but also click on it to be sure it's from the source you trust. --- until Verisign is replaced with the unicode look-alike to itself.