So you prefer to have something (which most people have ) with root privileges to pull data unattended, 52 times a year, from some 3rd party host via python then to manually do (if you wanted ONLY once in 3 years) something once a year manually?
Is this really what i am reading?
Certbot isn't the only acme client in town. I use Chef personally: https://github.com/schubergphilis/chef-acme/
Professionally, it's not once every three years, it's that x the number of clients we host. Which is a lot. Many are clamoring for LE, because it's within their budget: $0. So yea, I want to automate that.
I have another cronjob that fits the same description, runs daily, and it's called "unattended security updates". Just saying.
Edit: Also, it's a persistent myth that certbot needs to run as root. It most certainly doesn't on my servers.
I have my certbot set to run once a week with --keep-until-expiring, so it will try to issue a new certificate when the old one's remaining validity is less than a month. I could also set it to run daily, because it doesn't actually do anything if the cert is still valid for long enough. But a week works on my (admittedly small) scale.
So unless you're experiencing a multi-week DNS malfunction or multi-week DDoS (in which case you're in some deep shit anyway), you should be fine.