Your response clearly states publicly accessible DNS. A CA does not require anything public for local SSL and can work in conjunction with whatever service they want for that which is public.

public domain for internal services

I guess they need a CA then

https://smallstep.com/docs/step-ca/

https://www.freecodecamp.org/news/docker-nginx-letsencrypt-easy-secure-reverse-proxy-40165ba3aee2/

That is how it works, infinite budget and student resources

https://www.tomshardware.com/tech-industry/huawei-officially-opens-its-2600-acre-randd-center-in-shanghai-will-accommodate-over-35000-scientists-and-engineers

Even intel is using TSMC for their latest 200 series chips. Technology is one thing, doing it at scale is another. Samsung is close but still behind.

https://www.tomshardware.com/news/samsung-says-it-will-beat-tsmc-to-4nm-production-in-the-us