A CA has a responsibility to verify that the person requesting a certificate for a domain actually owns the domain in question. It is not up to the CA to perform censorship of domain names, nor to police what people do with a certificate once they have it.
Now, your concern is already kinda addressed by the higher levels of SSL certificates, but it's up to the corporation applying for the cert to spend the extra time and money to get it.
There are effectively two levels of certificates you can buy: Domain Validation (DV) and Extended Validation (EV). DV certs are designed to have automated issuance and are the type of cert that Let's Encrypt issues. EV certs have much higher levels of vetting before issuance, and require phone calls, paperwork, etc.
Only CAs who pass an independent qualified audit review may offer EV, and all CAs globally must follow the same detailed issuance requirements which aim to:
Establish the legal identity as well as the operational and physical presence of website owner.
Establish that the applicant is the domain name owner or has exclusive control over the domain name.
Confirm the identity and authority of the individuals acting for the website owner, and that documents pertaining to legal obligations are signed by an authorised officer.
Note that for EV certs, the legal entity applying for the cert needs to be a corporation, not an individual, and the corporation name is included in the cert, and appears in the status bar of your browser.
ex: non-EV cert:
ex: EV cert:
Notice how PayPal's legal name appears in the address bar? That is next to impossible to spoof, and we are raising the bar for spammers: the only way to get "PeyPal, inc" there would be to actually incorporate a company, which criminal organizations typically don't want to do. So once users get used to looking for this on big-name websites, this problem will kinda solve itself. Unfortunately, because of the amount of manual verification involved, EV certs are expensive (hundreds of $USD per year), and CAs like Let's Encrypt or godaddy will never offer them.
Generally speaking, a CA is like the passport office or the bureau that issues driver's licences; they have a responsibility to ensure that A) you are who you say you are, and B) that you have met the requirements (ie you are a citizen / you have passed your driving tests). They have no responsibility to track what you are doing with that ID, nor is it legal for them to revoke your passport / driver's licence even if you do use them for illegal purposes.
Is there a history of certificate issuers revoking certificates because of nefarious use, even though they don't have a legal responsibility to do so?
No, Definitely not. A CA would get shut down if they did that.
Think about it this way: Certificate Authorities need to be a completely neutral and globally trusted 3rd party. If they have the power to make judgments on what counts as "nefarious" and revoke certificates based on that, then they wouldn't be neutral and globally trusted, now would they?
You might think that the browser could get together and make a strict set of rules for what counts as "nefarious" so that the CAs are then only enforcing the rules. But what would that actually accomplish? Phishers and scammers are very good at slipping through the rules. We would likely spend more time and effort arguing about the rules than the amount of benefit we'd get from it.