That would require ssl certs to be shared to the agency.

Agreeing with everyone though, it's a wrong reason, but I can fathom why someone would do it.

No, the outside agency can obtain a new cert for just that subdomain. They can even use letsencrypt! (Although they really should use EV for this type of site.)