> nobody in their right mind is going to onboard a new service/device without automated renewal in 2026

We're talking about people that didn't bother about an event scheduled in 365 days.

Why would they care about something that may happen in 2029?

No later than last week I had to setup a service using a 365 days cert that was provided to me as a ZIP archive.

The provider have everything in place to set automated renewal.

But they decided against it because it forces providing us with (scoped) API access to the provider.

Instead they put a reminder in Outlook and forgot about it.

Hopefully in ~50 weeks from now someone will see the reminder, decide to act on it, find someone available with access to the provider to renew the certs and someone available that'll read the doc I had to wrote explaining how to put new certs in place, someone willing to schedule the operation... all of that before the certs do actually expire.