As the name implies, Extended Validation certificates require a much more rigorous verification requirements than OV. While you're correct that the CA isn't guaranteeing the legality of the site, they are vouching for (11.1.1.) much more than they would be in the OV case.
- Verify Applicant’s existence and identity, including;
- (A) Verify the Applicant’s legal existence and identity (as more fully set forth in Section 11.2 herein),
- (B) Verify the Applicant’s physical existence (business presence at a physical address), and
- (C) Verify the Applicant’s operational existence (business activity).
- Verify the Applicant is a registered holder, or has control, of the Domain Name(s) to be included in the EV Certificate;
EV Guidelines, v. 1.6.2 15
- Verify a reliable means of communication with the entity to be named as the Subject in the Certificate;
- Verify the Applicant’s authorization for the EV Certificate, including;
- (A) Verify the name, title, and authority of the Contract Signer, Certificate Approver, and Certificate Requester,
- (B) Verify that a Contract Signer signed the Subscriber Agreement or that a duly authorized Applicant Representative
- (C) Verify that a Certificate Approver has signed or otherwise approved the EV Certificate Request
While 11.1.1.(1)(C) might seem to be a contradiction with the exclusion for the company's activity, it means that the entity was active at the time of application for the EV certificate, though the CA cannot guarantee that the entity is still currently active.
11.14.3. Specifies that the CA cannot use data older than 13 months to support issuance of certificates, and EV Certificates have a maximum lifetime of 825 days (and as of 1 March 2018 all certificates will have this maximum). Thus, an EV certificate certifies that the entity was active within 13 months of the issue date and it will be trusted for a maximum of ~27 months from that date.
Each of the verifications above is also more rigorous; for example:
11.2.2 (4) Principal Individual: A Principal Individual associated with the Business Entity MUST be validated in a face-to-face setting.
The description of the requirements for this face-to-face validation goes on for a full page.