The problem is then the reputation to humans reviewing links. A legitimate company sending from legitimate-company-transactional-emails.com looks exactly like a phishing scam sending from legitimate-company-scam-emails.com. This can be mitigated by not putting anything important in the email ("You have a new message on MyChart, figure out on your own how to view it."), but people will be confused and it will waste support time.

It's honestly really bad no matter which route you choose, which is why everyone is so intent on getting you into their mobile app that can spam you without affecting their reputation.

Also, even if marketing emails are sent from a separate domain, sales people can be sending so much "spam" that your normal humans-at-the-company emails start getting rejected. I think this might have happened at my last startup; email reputation got bad, interview candidates didn't get their interview conformations anymore. But I might be misremembering.

Subdomains are basically restarting your domain reputation from scratch. I would use the apex domain and a validator in most cases, as long as you're doing the right thing and maintaining list health. Obviously mega-corps might be different and have needs for subdomains.