The barrier is actually bigger than just money: for an EV certificate you need to prove that you are a registered business. So there is a name and an address behind it, which is kind of a barrier for malware.