This seems solved if everyone just uses ACME
Intermediate cert was referred to by name in the cert chain but not served by the server in full.
Server was of course referencing the newly signed intermediate cert (called L3 I believe) but the client only had a stale copy/ version of L3 signed by an expired trusted cert.
Issue was on an embedded device that couldn’t be fixed so the newly signed intermediate cert needed installation everywhere manually
Manual cert deployment is IMHO bad hygiene in this day and age. (Yes, I know there’s esoteric hardware and stuff like that where automation isn’t straight-forward, but that’s the exception, not the rule.)
E.g. on AWS there’s Certificate Manager, which is similar. (But obviously only usable for people on AWS.)
Maybe in your world but plenty of us work in places that have 1000s of servers, many of them internal, they don't support LE or there are security concerns with opening external firewalls just to support certificate updates so it still has to be done manually.
You might be lucky to work somewhere much smaller/newer that doesn't have the problem but please don't make disparaging statements about those of us who have to do this manually.