I've been reading a lot trying to figure out why I would set-up a "multi-domain - one forest" architecture but I haven't found any good reason to do so. I came to the conclusion that you better use "one domain and delegations" or "multiple domains with trusts".
There is one quote which is central for me:
"Because a domain is not a security boundary, it is possible for a malicious service administrator, such as a member of the Domain Admins group, to use nonstandard tools and procedures to gain full access to any domain in the forest or to any computer in the forest. For example, service administrators in a nonroot domain can make themselves members of the Enterprise Admins or Schema Admins group."(Source)
Is there anyone who could think of a scenario where you would use one forest with multiple domains?
Thank you