No they should not be marketing gimmicks!
Certificates are not issued to just any one.
Companies that are trusted issuers, do research on someone requesting a certificate that he indeed is who he claims and that he has a legitimate business.
If for example you connect to a website that is fraud but has obtained a certificate from Verisign (mentioned as an example), I would expect that you can do many legal actions against the (both site and issuer).
SSL is based on trust which is a very thin concept when it comes to computer security.
If the trusted issuers are not doing their job good enough, then security goes down the drain.
Personally I don't know if there is any historic example on this (I hope there isn't any)