Speaking for myself, the causality flows in the other direction. Because there will always be somebody like Comodo who will issue certs with insufficient verification (Comodo being an extreme but there's been a long history of merely insufficient verification; ISTR a lot of "fax me a letter on official letterhead", which is just total BS), the PKI component of SSL, being basically a binary yes/no system, is fundamentally flawed. Market forces compel a race to the bottom in this situation and there's just no way around it. (Not even moving it to a government function; nobody is immune to having money waved under their nose.) So all you get from SSL is encryption, not authentication. Whether you like it or not.

If you really insist on the dichotomy of "SSL provides either perfect security or no security", then the answer is, it provides no security, because it is impossible to use it properly.* The legitimate owner can do everything right and still get CA-rooted with non-zero (and significant-in-practice) probability.

If that's a problem, get designing and implementing.

* Or, even more precisely, the only proper use is to use a separate communications channel with the website to verify the key they are sending out, regardless of who putatively signed the cert. And this use is a myth in the general case, because I can't imagine more than the barest fraction of SSL sites have ever gotten this query and I bet the majority of organizations would either have no idea what to tell you since you can't talk to the guy who knows (if any), or would even think you were a hacker or something trying to get something from them you shouldn't.