Something I've had to explain about ADCS more times than I can count: certificate templates are not part of ADCS.
They live in Active Directory's configuration partition, under Services → Public Key Services → Certificate Templates. The full LDAP path is CN=Certificate Templates,CN=Public Key Services,CN=Services,CN=Configuration,DC=...
ADCS reads them. AD owns them.
This isn't a pedantic distinction. It changes how you reason about the whole stack.
Uninstall ADCS from every server in your forest. The templates are still there. Templates replicate through normal AD replication, like users and groups. Every CA in the forest sees the same templates because they're reading from the same directory. You configure a template once, every CA in the forest can issue from it.
AD is the identity and authorization layer
What this really means is that AD provides the identity and authorization layer for the CA. Who you are, what groups you're in, whether you're allowed to enroll in a given template, all of that is decided in AD before the CA gets involved. The CA's policy module evaluates the request and the signing engine does the cryptographic work, but the eligibility decisions live one level up, in the directory.
In classic PKI architecture this work is split across an RA and a CA. In Microsoft ADCS, AD is doing most of what an RA does, and the CA does the rest. Either way, the practical consequence is the same: if you're hardening your PKI by working only on the CA, you're working downstream of where the decisions are made.
Why ESC paths are really AD problems
This is also why ESC paths are mostly AD object permission problems wearing a PKI hat. Template ACLs are AD ACLs. Enroll permission is an AD extended right. Group membership decides who can enroll because group membership is an AD construct.
The vulnerability isn't in the CA's behaviour. The vulnerability is in the AD permissions that govern who can ask the CA for what.
You've probably been at the AD level the whole time
Here's the part that often surprises people: when you open the Certificate Templates Console and edit a template, you're editing an AD object. The console is just a friendlier UI on top of the directory.
Make a change there once, every CA in the forest sees it. Because the template lives in one place, and that place is the directory. The downloadable handout linked above shows Active Directory Sites and Services with the Services node enabled, browsed to Public Key Services — Certificate Templates sitting alongside Certification Authorities, Enrollment Services, and NTAuthCertificates.
When was the last time you opened Active Directory Sites and Services, enabled View → Show Services Node, and looked at where your templates actually live?