There's one aspect, connection security, which either you have or you don't have. There's no useful purpose to an icon which is always there and people can then ignore. For practical purposes, browsers should only inform people when their connection is not secure, so people can assume security the rest of the time.

Then there's the other aspect, identity. Is this really PayPal? Honestly, most users will never be able to notice if it's not. Who cares what host is in the address bar, or if it has a valid cert, or if it's plain http? Average users don't scrutinize these things because they don't know what a certificate is, or encryption, or how domains or web pages work. If it looks like Paypal, they assume it is.

EV certificates have always been a scam. I don't think users know they exist, and I don't notice at all when I am on a site that uses one, unless I look really hard and click some buttons and read around. Even when I do (in Firefox, for example), no part of the UI explains to me that this company paid for an expensive process to prove this website is owned by this legal company. It just says "This is Bank of America Corporation (US), verified by xyz". Well, yeah, I would have assumed it was anyway, and I don't know what "verifying" implies. On an identical site without an EV using a phishing domain, it would simply not have this information, and nothing would seem amiss to me at all. So EV does nothing for me as a user.

What is more useful are apps. Apps in an app store do tend to pop up the most authentic result first. You can see this app is Bank of America, and the app was made by Bank of America Corp. Seems legit. If a phishing site popped up a phishing app, and it wasn't made by Bank of America Corp, I might be suspicious enough to double check it before installing it, but maybe not.

If the first time I visit a website the browser displayed some information about the domain, certificate, etc, that would be similar to what the app store does. "This is Bank of America website, owned by Bank of America company, and we legally verified it with X verifier." Or, "This is Bank of America website, it has not been legally verified". Or, "This website is Bank of America, and is registered and geo-located in Lithuania". That would seem odd.

Another failure of browsers: I just visited https://www.bankofamerica.com/, right cliked, clicked View Page Info, and then clicked the Security tab. (Honestly that's way too many clicks, and too hidden) It says "Have I visited this website prior to today? No." Which I don't think is true actually, but anyway, it at least is one hint that maybe I should be suspicious.

I think the browser should provide a button called "Identify" that when you click it, it tries to give you an idea of how much you can trust this page. Show me who owns the domain, the DNS, Geolocation, EV information, the URL, have I been here before, does it match any tracked lists of malware URLs, is it in an IP pool commonly used for cybercrime, etc. Everything I need to get a feeling for if it's trustworthy. And specifically, throw up red flags where something might not be 100% trustworthy. I probably do not care if abcnews.com is not 100% trustworthy, but I do care if Paypal is, so I want a button I can press that will tell me if it isn't.