One of the risks involved in making a VMCA the subordinate CA is the fact that anyone with access to the PSC can regenerate Machine SSL certificates for the PSC(s) and vCenter Server(s). In other words, VMCA completely relies on the operating system it is running on, such as Windows/PhotonOS, to secure the key stores. Anyone with root access to the node that's running VMCA can easily read the certificate authorities' root certificate.
Therefore, VMware allows for a much more secure approach, which is commonly referred to as the Hybrid method. In this approach, the Machine SSL of vCenter and PSC are replaced with custom certificates from the Enterprise CA. VCMA is only used to issue certificates for the solution users and ESXi hosts.
The following diagram depicts the Hybrid approach:
