Most big sites like facebook are going to be hardened against XSS and CSRF attacks. Facebook owns all the domains of similar spellings.
XSS and CSRF are rarely used.
Phishing exploits human stupidity, and there is nothing they can do to fix that. Nothing they can do to stop people from infecting themselves or handing over their passwords ;-)
For example, you can impersonate an email from their boss, teacher, university, coworkers, friends, etc.
For hacking their computer, you're tricking them into running malware basically. Then using the malware to dump their credentials or keylog it.
For credentials, they will never own all domains, especially since nowadays there are so many odd TLDs like .online, .rocks, .store, .tech etc. For example, currently, facebookportal.me is available. So is faceboook.fun. A lot of times phishing sites are hosted on hacked websites with completely irrelevant domains, and yet stupid people still fall for it.