In more detail
The owner of example.com can create any number of subdomains with DNS records at no extra cost, to separate a blog, an app or a staging site. Each one is defined by its own record, usually A, AAAA or CNAME, and a wildcard record *.example.com answers for any name not defined explicitly. Subdomains can be nested, as in api.eu.example.com. Browsers treat each subdomain as a different site for most security rules, but cookies set for the parent domain are shared with all of them.
Why it matters
Unused subdomains with leftover DNS records can be hijacked: if shop.example.com still points at a deleted cloud service, an attacker can claim that service and serve content under your name. A wildcard certificate for *.example.com covers shop.example.com but neither example.com itself nor a.b.example.com.
Example
blog.example.com. 3600 IN CNAME blog-host.example.net.
app.example.com. 3600 IN A 203.0.113.20
staging.example.com. 3600 IN A 198.51.100.30
Common confusion
A subdomain (blog.example.com) is a separate host name that can live on a different server; a subdirectory (example.com/blog) is a path on the same site.