SubjectAltNames should always include the common name, modern browsers won’t even look at the common name value any more (because it’s validation algorithm is not well defined, whereas it is for subjectAltNames).
More fun than generating this cert would be doing an analysis of who will accept it, who will reject it and who will accept up to a point. (Obviously I dontbexpect anyone to issue it, if you handed in a CSR for it.)
The Baseline Requirements require that Public CAs ensure CN if present (which for compatibility it usually will be) is set to the same name as one of the SANs. Historically breaches were not uncommon, but as noted above now these certificates won't work as intended in Chrome so that's another practical reason above getting a slap on the wrist from m.d.s.policy.
My point being the Common Name missing from the Subject Alt Names is the least of the problems with this certificate.