Also, does it not complicate any possible revocation scenarios in that if one host is compromised then they'll all need to be changed?
When the private key (for which the certificate is associated) is compromised, then the certificate(s) for that key are revoked.
Whether or not the certificate applies to a single domain, many Subject Alternative Names (SAN), or is a Wildcard certificate; it is still a single certificate and does not complicate the revocation process.
And supposing there are other certificates for the same domain(s), if they are from different uncomprimised private keys, then those will not be affected by revocation of the aforementioned certificate. Domain name overlap notwithstanding.
Surely this is information leakage allowing a would-be hacker to glean more information about your organisation than you intend?
It is quite possible that a SAN will list a subdomain that could not be found otherwise except by Brute Force, I think in this particular case, these subdomains are probably easily found by other means.
Even if they were intended to be secret, software designers should not rely on the secrecy of their hostname. This is stored in browser history, synced to the cloud, and likely emailed to co-workers.
So the fact that SAN lists these domains might save an attacker some time in finding subdomains, publication of this information is not considered a vulnerability.
The real risk for vulnerability would be in the application, and that is where the security focus should be.