from a security point of view it does kind of make sense to have non-trusted content hosted under a separate domain. so if they were using a third party to host

from a security point of view it does kind of make sense to have non-trusted content hosted under a separate domain. so if they were using a third party to host the breach page it may have been risky to have it hosted under the .equifax.com domain. this is why you have .github.io and googleusercontent domains, etc. though, probably the risk from confusing users is worse than the risk from the third party playing silly games with cookies in this case.