In the standard way of configuring cookies, allowing third parties to use a subdomain of your domain lets them collect your HTTP_ONLY SECURE cookies and impersonate your users.

The security policy at the FAANG I used to work at required third party vendor code to run on other domains for this reason.