I think the defensive aspect is underestimated. I know from personal experience that carving out a clear online domain name is a lot harder with the expansion

I think the defensive aspect is underestimated. I know from personal experience that carving out a clear online domain name is a lot harder with the expansion of tlds. Also, I expect phishing sites will have an ever easier time registering convincing domains. So we're going to end up relying on browser blacklisting... not exactly an improvement for security.