Yes, phishers probably aren't going to get TLDs due to cost (at least in the short term). But most companies that legitimately get TLDs will likely exercise as much oversight over subdomains as current .com registrars do -- that is, practically none at all.

While you won't be able to get the paypal TLD, I'd be surprised if paypal.shop is appreciably harder to get than paypalshop.com