Considering the PCWorld group in the UK have had to disclose a serious breach recently, plus they have not bothered to update their EV certs, i'd suggest their security isn't up to scratch and black hats will notice this.

Add PayPal. And theirs is an EV cert "valid" till 2019. Bet they're happy having to go through the process all over again.

Also accounts.intuit.com which affects various products e.g. Mint.

And an interesting comment from the thread:

Enforcement of this error can be disabled by setting security.pki.distrust_ca_policy to '1' in about:config. Changing the value back to '2' will re-enable this change.