[biot]

It's so people can't use one wildcard cert to have facebook.com.example.com and google.com.example.com, potentially tricking users.

[icebraining]

I don't think that's a valid reason, because you can get a cert for * .com.example.com, hence you can have those domains.

[biot]

Very good point.