You need to make sure your keep your private key private. It's as simple as that.
A CSR (certifcate signing request) does not contain your private key.
Services such as the ones you mention frequently offer two modes of operation:
- You can upload a CSR and they will sign the certificate contained therein or
- They can generate the CSR for you
While the latter one (they generate the CSR for you) is usually meant as convenience feature as you don't have to maintain the proper tools to reate a CSR on your own computer, it means in practice that they will generate a private key for you, which at the same time means they could easily keep a copy of your private key.
And anyone who is in possession of your private key may issue additional certificates with your name on it or revoke your certificates.
Which means in short words: As long as you make sure your private key never leaves your machine (i.e. you create the CSR locally on your machine and uplopad it) you can use any of those services without worries.
If you leave it to them to create the private key for you, you need to trust them that they will not cause any harm with it.