If you are the one putting in the “www.paypal.com” into your browser, you’re fine.
This affects the “pay with PayPal” buttons on a merchant’s website that can steer you to a phony PayPal screen that fools your browser into thinking it’s legit.
Wrong. You’re thinking of a much more primitive type of attack. This is way more sophisticated.
If I’m on your LAN (or simply have a rooted box on your LAN), I can hijack your DNS request and trick your machine into resolving your request for paypal.com to point to me instead of the real paypal.
When I do that, the only way you can know that you’re talking to a phony is via a certificate. However, this attack tricks your machine into accepting a forged certificate.
It is quite nifty.