> Every place I've worked which has had issues with last minute certificate changes or expiring certificates without renewal has had a systemic problem with underpaid and understaffed IT department.

That's an interesting anecdote, but its quite easy to find examples of companies with well respected, well paid engineering teams that still have an occasional certificate expire. Microsoft[0], Spotify[1], Facebook[2], Apple[3] have all had embarrassing outages due to certificates expiring.

[0]: https://www.theverge.com/2020/2/3/21120248/microsoft-teams-d...

[1]: https://www.theverge.com/2020/8/19/21375032/spotify-down-son...

[2]: https://www.theverge.com/2018/3/7/17092084/oculus-rift-heads...

[3]: https://www.theverge.com/2015/11/12/9721108/apple-mac-app-st...