Why not use full domains for a service like this? Instead of client.your domain.tld, register client-your domain.tld. This would prevent one bad actor from nuking your whole business. Yes it has a cost, but it’s like $10 a year for a new domain, which I bet pales in comparison to other direct costs of running a SaaS.
So let's look at this situation. It's a shop page, shop.{clientdomain}.tld. Now you need SSL for this, using AWS you need a TXT record from their ACM. You also need a CNAME to your domain (ideally) or to a Cloudfront instance. For your customer you now need them to make 2 DNS entries. This is from my experience having non-profit like entities setup DNS. - Well the person who set that up stopped responding, isn't ther…
The best reason not to do full domains is the risk of bad actors re-registering domains you release, as schroeding points out in another reply.