True but you can have cert-manager issue public certs then create service accounts for off cluster things to be able to pull the cert from the Secret so k8s+cert-manager acts as a local broker that handles renewal.

You can also invert and have k8s cronjobs provision the generated certs into other infra

With this setup, you don't have to worry about the RHEL certbot snap updating to a broken version which gets blocked by SELinux...