This only works because it’s a wildcard certificate. Since 2019, TLS certificates must not be issued for names containing underscores <https://cabforum.org/2018/11/12/ballot-sc012-sunset-of-under...>.

Interesting, however that goes back to my original question about platforms allowing users to create a sub-domain, as they almost always use a wildcard certificate for this purpose. [1]

I suppose the saving grace is that they can only create the _for-sale and not any of the attributes specific to the intent to sell.

[1] - https://youstareintoconanssoul.ytmnd.com/