If you installed it with pip, it doesn't; if you installed it with an OS package or snap, it does (although it also didn't in that case for about the first year and a half of its existence, I think).

Can confirm, I have been using certbot+apache in production across multiple servers from Ubuntu apt repos since 18.04 in 2018 and scheduled auto-renewal is the default.

But if certbot doesn't run on schedule, presumably it will never connect to ARI either.

This is why Certbot should only be used temporarily to transition from legacy infrastructure. Ideally cert management (ACME client) needs to be baked into the server, like what Caddy does.

About the last thing security-wise that I want is for http server to control DNS record (which is required to have wildcard certs in LE)

When done properly, this is less of an attack vector than you think (certainly much less than a phishing email).