The solution that we use for this is to have a separate domain for dev with its own wildcard certificate, like company-dev.net.
EDIT: it's common courtesy to explain why you downvote a post, as it stands I'm going to make the assumption the downvoters are simply too lazy to do things properly.
I know two, at least. For a small communitary school in my city, teachers and students keep blogs in a wordpress multi user server, for storing data or doing webdev examples. They have a subdomain setup and cannot use ssl as the domain name will always be unknown by the person who creates the blog and the wildcard is too expensive for something they do in their free time.
Sandstorm uses unknown subdomains as a way to avoid possible security issues https://docs.sandstorm.io/en/latest/administering/wildcard/#...
I'm sure your points are valid, but you cannot define the thread model of others so easy. And don't get mad by downvotes, upvoting or downvoting is pretty boring