But it got me wondering - does that actually protect me from attacks like homograph attacks or overlong encoding attacks?
No. A homograph attack would show you
vοdafone.de but the first
ο isn't really
ο. From your browser point of view, the domain is valid, the certificate is valid, and issued for that domain. You would read the information on the certificate and it would deceive you.
How you can protect yourself? By checking if the domain you are seeing is a homograph or not. There are tools and browser extensions for that.
Using a password manager helps immensely too. A password manager will not be fooled by the homograph. For it,
vοdafone.de are completely different domains, even if for you (and me) they look the same. If you try to login and your password manager complains that it does not recognize the domain, make sure to check if the domain is really what it looks.
Are certificate issuers bound to some standard about checking the domain name that they are signing?
They should, but that's not always the case. There were several instances of a fraudulent Google certificate caught in the wild. So even if the Certificate Authorities are bound to check if the entity requesting the certificate is entitled to that certificate, sometimes they get confused and issue a certificate when they should not. Other times they are compromised and attackers can use their infrastructure to issue fraudulent certificates.