Wildcard certs are generally discouraged in secure environments due to a single cert being compromised can lead to a variety of compromised services -- or an attacker adding their own subdomain and 'valid' service.
Yet when it's, say, a certificate for the HomeAssistant service at my personal residence, avoiding the subdomain being published to the transparency log is advantageous from a both a privacy and security perspective.
Naturally, best practices depend on the use-case and context.