Agreed, there is a problem with how certs are managed in large organizations.
Many believe a Wildcard cert is a license to copy the same private key and cert everywhere. They have no problem
copying their single private key to budget VPS services or foreign providers
who are known CLOUD and collection program participants, the
same private key
used for "high security" on premise servers.
Also amusing to see some organizations using ACME cert tools manually on each
and every server in fleets of 10 to 100, every 80 days or so, when they remember to do so. Outages
tend to be pretty frequent due to missed renewals.
The only solution is automation, whether with an off the shelf ACME client with
a cron job or a more complete automation platform. Let's Encrypt is not the
only CA that supports automation, there are quite a few that support ACME or
other nonstandard APIs. There is almost no setup that cannot be fully
automated: legacy web servers, hardware load balancers, cloud load balancers,
etc.
It is also absolutely possible to automate OV and EV renovation if an
organization insists on these "fancy" certs, which are frankly irrelevant to
security because browsers do not treat them differently in any significant way.
You can't pin a domain to only OV or EV type certs, which would be useful. The
documents used for validation need to be updated periodically (data reuse
times are going down too), but the rest of the process can be fully automated.
I do not see any reason not to automate cert renewal given the changes in
lifetimes, although I feel for the hobby server operators who have to deal with
more complexity. For hobby use cases, just set up an ACME client with a cron
job and be done with it.