Can a third-level domain purchase a wildcard SSL certificate?

Yes, it is supported.

As long as the domain name is registered and within its validity period, and you can complete the domain management authority verification, a third-level domain can also purchase a wildcard SSL certificate.

For example, *.sub.example.com can protect all peer subdomains such as a.sub.example.com and b.sub.example.com.