Maybe the question is wildcard vs SAN certs. With automated cert issuing/renewal, they could theoretically talk to e.g. Cloudflare's API to get your DNS records, if you're with them, and then regenerate a new SAN cert containing exactly the subdomains you really have whenever that list of subdomains changes. Which is
probably more secure in some way I don't understand.
You're right about the "just using a bunch of separate certs" solution being slower, though, especially with HTTP/2 (which, because of origin combining, uses exactly one real socket per TLS cert.)