I don't know if it handles this unexpected-revocation scenario, but as Apache has had support for automated Let's Encrypt for a while now (I finally upgraded last week, when I realized I was missing out on this feature), I'm surprised that nginx doesn't?
I believe they mean ACME provisioning and renewal isn't baked into nginx, i.e. you have to install certbot separately and run it daily from a cron job or systemd timer, whereas traefik and caddy handle this for you without additional software or configuration.
I understood that. As Apache does have a way for me to internally automate all of that, without using an external tool such as certbot, I am surprised that nginx doesn't as well. Either way, you should add Apache to your list of servers, along with caddy and traefik.
I don't know if I agree that this is "it does" as this isn't really "not out of the box" and kind of "fully external", but what I continue to be surprised by is that Apache DOES come with this functionality, "out of the box" (via a first-party module--and btw everything in Apache is built out of modules, including protocols--that ships with Apache and is configured inside of Apache), while nginx doesn't. I feel like the decision to use Apache has been vindicated throughout the ages, time and time again ;P. (There was a very short period of time when nginx was "faster", but not only did the world move on to ubiquitous CDNs anyway, but Apache quickly responded with mpm_event, which eventually became the default.)