Agreed, there is a problem with how certs are managed in large organizations. Many believe a Wildcard cert is a license to copy the same private key and cert everywhere. They have no problem copying their single private key to budget VPS services or foreign providers who are known CLOUD and collection program participants, the same private key used for "high security" on premise servers.

Also amusing to see some organizations using ACME cert tools manually on each and every server in fleets of 10 to 100, every 80 days or so, when they remember to do so. Outages tend to be pretty frequent due to missed renewals.

The only solution is automation, whether with an off the shelf ACME client with a cron job or a more complete automation platform. Let's Encrypt is not the only CA that supports automation, there are quite a few that support ACME or other nonstandard APIs. There is almost no setup that cannot be fully automated: legacy web servers, hardware load balancers, cloud load balancers, etc.

It is also absolutely possible to automate OV and EV renovation if an organization insists on these "fancy" certs, which are frankly irrelevant to security because browsers do not treat them differently in any significant way. You can't pin a domain to only OV or EV type certs, which would be useful. The documents used for validation need to be updated periodically (data reuse times are going down too), but the rest of the process can be fully automated.

I do not see any reason not to automate cert renewal given the changes in lifetimes, although I feel for the hobby server operators who have to deal with more complexity. For hobby use cases, just set up an ACME client with a cron job and be done with it.