The asterisk must be the entire left-most label (RFC 9525 §6.3 allows exactly one wildcard, as the complete left-most label); w*.example.com and *.*.example.com are not accepted by public CAs, and wildcards directly under a public suffix such as *.co.uk are refused. Public CAs validate wildcards only by DNS-based methods, so ACME issues them only through the dns-01 challenge.
Trade-offs: one key serves many hosts, so its compromise affects all of them, and every server holding it becomes a place it can leak from. Wildcards also hide individual host names from Certificate Transparency, which is sometimes the motivation. With automated issuance, per-host or multi-SAN certificates are usually the better default.