An associated-domains entitlement uses a wildcard applinks host (e.g. applinks:*.example.com). Overly broad universal-link claims widen the deep-link attack surface and can enable link hijacking if any subdomain is attacker-controlled.
An associated-domains entitlement claims a wildcard applinks host such as applinks:*.example.com. Every subdomain then feeds universal links into the app, so an attacker who controls or registers any subdomain can drive deep-link handlers that were trusted as first-party.
A wider deep-link attack surface: link hijacking and unexpected in-app navigation from hosts you do not actually control.