Telling users to carefully type https://www.paypal.com is somewhat less user friendly but a lot less phisher friendly than the "just type the company name, the other bits don't matter and the browser will find the right site for you and tell you it's secure" pattern.

Paypal has good SEO, but not every shopping cart does, and its not like Google are manually vetting the content like AOL keywords did...