The risk in both of theses is vastly different. A root CA leak is hard to detect, has tremendous consequences, and adding limitations to the cert (TLD/domain)

The risk in both of theses is vastly different. A root CA leak is hard to detect, has tremendous consequences, and adding limitations to the cert (TLD/domain) don’t work across every OS. OTOH, leaking the existence of your private services (which are likely inaccessible over the internet for the general attacker) is a much smaller risk, and can be contained with wildcard certs as a workaround.