Personally, I think freezing the domain is preferable to logging in and killing a (likely rather important) process.

But then, the discussion is academic. I've never had to shut down a domain to prevent heavy legitimate or runaway process use from harming other users.

I have shut down many domains to stop abuse, but that's a very different thing. If you want to examine a compromised disk, you are best off doing so booting off of read-only media then carefully examining the compromised partition, so you want it shut down anyhow.