A private CA you ship
A vendor generates its own root certificate, puts it in the product, and asks the customer to install it into the trust store of every device they browse from. It costs nothing to issue and it works with no network at all, which is why it is the first thing a vendor shipping a box reaches for.
What the customer has to do
The root goes in by hand, once per operating system. Start9 documents the steps for Windows, macOS, Linux, iOS and Android, and on iOS it is two steps in two places: the profile installs only through Safari, and trust is enabled separately under Certificate Trust Settings.
A trust store belongs to one device and one person. The customer who installed the root is fine. The colleague they send the link to is not, and neither is the phone they replaced.
What it cannot reach
Anything that is not a browser keeps its own trust store, and often has no way to add to it: a webhook from a payment processor, a mobile app with pinned roots, a CI job, a scanner. None of those get an exception made for them, and the vendor hears about it as a bug in whatever was trying to connect.
What the root is worth to somebody else
A root sitting in a customer's trust store can sign for any name it was not explicitly constrained against, which makes it a key worth stealing for as long as it stays installed, on every device it was installed on. A DNS-01 credential signs nothing and opens one hostname.
The vendors who built the other answer
Plex runs plex.direct on a wildcard, where 1-2-3-4.hash.plex.direct resolves to 1.2.3.4, so a server on somebody's LAN gets a publicly trusted certificate with no domain and no inbound connection. Unraid ships the same shape as ipaddress.hash.myunraid.net, balena gives every enrolled device a public URL, Nabu Casa sells Home Assistant owners a remote address, and OctoEverywhere is a company whose product is putting an OctoPrint instance on one.
Each of those is DNS and a certificate authority, built in-house and then maintained. It is the alternative to a root install, and it is the thing we are.
The quickstart goes from an address to HTTPS, and the other comparisons cover the rest of what people use instead.