I suppose because the certificate changes more often and it’s more reliable/predictable to change the server cert than DNS? If you ARE rotating the SNI public keys I’m assuming you can easily support multiple active at the same time.