One problem is that if a subdomain gets hacked it can be used for XSS as subdomains are trusted by the TLD, which might be a reason why they don't want every division to use a domain under the TLD.