It's a different attack vector.

Session tokens should be stored in an httpOnly cookie, so they're not accessible to a third party script.

CNAMEs could absolutely lead to leaked session tokens, but website owners should already be somewhat accustomed to hiding cookies away from third party subdomains. These days, lots of third party services run on subdomains... blogs, status pages, email click trackers, support desks, etc.