badguy.com would set the same flag, allowing a.badguy.com, b.badguy.com, c.badguy.com to count as fully independent sites
Why would that be a bad thing? What happens under badguy.com is badguy.com's business, is it not?
Is it any different than setting cookie scoping rules?