OK so Virtualmin is setting up the following redirects
https://vulture.xaerolimit.net:1000 is the machine name, and 10000 is where Webmin runs.
http://admin.grunk.xyz -> https://vulture.xaerolimit.net:1000
http://admin.grunk.xyz:10000 -> https://vulture.xaerolimit.net:1000
https://admin.grunk.xyz -> https://vulture.xaerolimit.net:1000
https://admin.grunk.xyz:10000 -> https://vulture.xaerolimit.net:1000
I never realized that was what was going on. Virtualmin creates this redirect when a domain is added. I've updated certbot to 3.1.0 via snap and made sure it's what VIrtualmin would call (moved the old binary to a different name for now but didn't uninstall it (the snap version installed to /snap and not to the system itself; I've just symlinked the snap version to /usr/bin/certbot.)
I don't know what made me think of it, but I went and created an A record of _acme-challenge.admin.grunk.xyz and that problem went away. But now it's replaced with a whole new error.
Web-based validation failed.
error: unknown command "certonly", see 'snap help'.
DNS-based validation failed
error: unknown command "certonly", see 'snap help'.
This one is most confusing. I still haven't found where Virtualmin is doing the redirects.