What are you looking to do? If it’s to do with a name server, you can delegate a subdomain and it’s children to be managed by another server using a ns record. This is actually how DNS works in general.

Yea your have a secure net, if you don’t want a VPN for each site, you at least make them connect via a VPN in a head office.

Because shops don’t want to run hardware on site, so they outsource the hosting of management and monitoring to the cheapest contractor. Unsurprisingly they don’t spend on security.