From the RFC The "_for-sale" leaf node name can be placed at any level of the DNS, except in the .arpa infrastructure TLD.
There used to be a number of sites that would let users create {username}.some.subdomain.apex.tld. Perhaps this is not a thing any more I honestly don't know. If it is still a thing and someone registers the username "_for-sale" they could cause some confusion.
Why allow any level of DNS? If you are selling a domain that should include the entire domain and thus the _for-sale should only be valid at the apex unless the goal is to cause legal problems for some big providers.
There used to be a number of sites that would let users create {username}.some.subdomain.apex.tld. Perhaps this is not a thing any more I honestly don't know. If it is still a thing and someone registers the username "_for-sale" they could cause some confusion.
Why allow any level of DNS? If you are selling a domain that should include the entire domain and thus the _for-sale should only be valid at the apex unless the goal is to cause legal problems for some big providers.