I think the flows are different. If I want to open up an account at amalgamatedbank.com, I probably type it in or I come from Google. Unless something is super

I think the flows are different. If I want to open up an account at amalgamatedbank.com, I probably type it in or I come from Google. Unless something is super wrong with my machine and someone's built an incredibly convincing bank website that matches what I would expect, I'm probably fine. Now think about coming back to that site after I've made an account. I may be coming from an email, a push notification, a text message, a targeted ad, etc. The risk is a lot higher because I'm not initiating the flow by using a trusted search engine or typing it myself. Or like, to be more succinct, it's because MITM rarely happens and phishing happens constantly.