Most phishers probably aren't going to have $50-100k spare either.
I think there has been a great misunderstanding with this scheme due to how its been reported by the likes of BBC News - applicants will have to submit business plans and demonstrate a technical capacity to maintain DNS servers - I bet they will have some pretty strict requirements by the time it's finalised, and I'm sure they will heavily scrutinise all applications.
It's not like any old Joe can just set up their own TLD overnight.
Yes, phishers probably aren't going to get TLDs due to cost (at least in the short term). But most companies that legitimately get TLDs will likely exercise as much oversight over subdomains as current .com registrars do -- that is, practically none at all.
While you won't be able to get the paypal TLD, I'd be surprised if paypal.shop is appreciably harder to get than paypalshop.com
I think there has been a great misunderstanding with this scheme due to how its been reported by the likes of BBC News - applicants will have to submit business plans and demonstrate a technical capacity to maintain DNS servers - I bet they will have some pretty strict requirements by the time it's finalised, and I'm sure they will heavily scrutinise all applications.
It's not like any old Joe can just set up their own TLD overnight.