its’ not practical to give everyone write access to the google.com root zone.

Someone will fuck up accidentally, so production zones are usually gated somehow, sometimes with humans instead of pure automata.

Why not ?

Giving write access does not mean giving unrestricted write access

Also, another way (which I built in a previous compagny) is to create a simple certificate provider (API or whatever), integrated with whatever internal authentication scheme you are using, and are able to sign csr for you. A LE proxy, as you might call it

Yes we do. That’s not the only thing they do of course.

It also sounds like the right people to handle certificate issuance?

If you are not in a good position in the internal organization to control DNS, you probably shouldn't handle certificate issuance either. It makes sense to have a specific part of the organization responsible.