Usually they make money with extended certificates where they not only offer a certificate for example.com but also certify that it belongs to Example Ltd.
Those extended certificates used to show the company name next to address bars, but I don't think browsers do that anymore.