You're right, it's not a problem for account.bbc.com, which off the back off your parent comment I've raised pull requests to get HSTS added. To answer why that

You're right, it's not a problem for account.bbc.com, which off the back off your parent comment I've raised pull requests to get HSTS added. To answer why that subdomain exists: firstly cookie compartmentalisation allows us to set particularly sensitive cookies off to a separate domain, as well as allowing us to do different arrangements for traffic management separate from www.