Not true. If you are hosting user content, you want their content on a completely separate domain, not a subdomain. This is why github uses githubusercontent.com.

https://github.blog/engineering/githubs-csp-journey/

I actually think they need 2, usually need a second domain / setup for failover. Especially if the primary domain is a novelty TLD like.. .IO which showed that things can happen at random to the TLD. If the website down it's fine, but if you have systems calling back to subdomains on that domain, you're out of luck. A good failover will help mitigate / minimize these issues. I'd also keep it on a separate registrar.

Domains are really cheap, I try to just pay for 5-10 year blocks (as many as I can), when I can just to reduce the issues.

And a second for when your main domain gets banned for spam for innocuous reasons.

I felt the need to get in addition to (shall we say) foo-bar.nl the foobar.nl the foo-bar.com and foobar.com because I dont want a competitor picking up those and customers might type it like that.

Don't forget about infrastructure domains, static-asset domains, separation of product domains from corporate domains ... there are plenty of good reasons to use multiple domains, especially if you're doing anything with the web where domain hierarchies and the same-origin policy are so critical to the overall security model.

For whatever it's worth, subdomain takeovers are also a thing and bug bounty hunters have been exploiting it for years.

A lot of interesting and informative rebuttals to this comment but no one anticipated the obvious counter argument.

Businesses only ever need two $10 domains, usercompany.com and company.com, just in case they ever want to host user generated content.

I think it's a sane practice to keep the marketing landing page on a separate domain than the product in case of SaaS.