Effect and usage of the domainlevel munchkin Initialization Parameter

Yes, it is quite buggy.  Luckily -- due largely to coincidence -- most sites will not encounter the bugs.  Yet because they've dodged the bugs due to luck as opposed to deliberate configuration, a seemingly minor change to site architecture can wreak havoc on tracking.  And there are some sites that are dealing with the bugs right now: they're missing Munchkin activities and they don't why.

First, some info about the modern web, domains, and cookies:

1. It is no longer traditional to have a site's canonical user-facing address be http(s)://www.{{zone apex of registered domain}} as opposed to http(s)://{{zone apex of registered domain}}, redirecting people from http://example.com to http://www.example.com.  While many sites have stuck with the old model, many huge and/or new sites use the reverse model: Twitter is a great example, as their canonical site is https://twitter.com, not https://www.twitter.com. The reasons for this change are many, including 140-character length restrictions and improvements to modern CDNs to embrace zone apexes.  The end result is that you can't predict, without actually visiting a site, whether it uses the old or new style.
2. It is no longer safe to assume that private organizations registering under a 2-letter ccTLD will be forced to register a 3rd-level domain (3LD) instead of a 2nd-level domain (2LD) right off the TLD.  Frankly, such an assumption was always deeply risky: .fr is a good example of a venerable 2-letter public domain with privately registered domains hanging right off it.  But it was at least less risky in the past, when .uk implied .co.uk and .jp implied .co.jp.  Now, ccTLD operators are openly inviting private, foreign organizations to register 2LDs, such as .io and .ly, which have become "cool" for cloud companies. With enough money and/or a locally incorporated entity, it's now easy to register right under a 2-letter TLD.
3. Most sites will want to track visits across all subdomains, meaning they want to set Munchkin cookies on .{{zone apex of registered domain}}.  The level of the registered domain, however, is utterly impossible to derive using just the length of the TLD.  For subsume.io the registered domain is an 2LD; for subsume.co.jp the registered domain is a 3LD.  There are no rules that can help you here, only a human-curated list like the Public Suffix List.  If the latest PSL or equivalent is incorporated into your browser, an accurate method is to see how high up you can write and read a cookie -- though the result will be different depending on the version of the PSL and old browsers will let you set higher than newer ones (in fairness, this can be okay as long that same browser never gets updated).
4. A small minority of sites may want to lock the cookie to only the current origin, such as only tracking hits to www.example.com and not pages.example.com. While small, this factor also complicates magically figuring out the best domain without deliberate configuration.

The principal problem is that Munchkin believes the length of the TLD is meaningful for predicting the registered domain when, as you can see in [2] above, this is plainly untrue.    For example, I can register figureone.mx.  If I go to http://www.figureone.mx Munchkin assumes the registered domain is the 3LD www.figureone.mx and sets a cookie accordingly.  If I go to http://info.figureone.mx Munchkin assumes the registered domain is the 3LD info.figureone.mx and sets a new cookie accordingly.  I'm sure you can see that can create a very difficult to troubleshoot situation... a tracking disaster.

The reason I mentioned that example.com works without further config is that Munchkin's intuition works for .com.  It also works for example.com.br because .br requires registrants to have a 3LD (3LD.{{mandatory public suffix SLD}}.TLD).

Adding additional confusion is that if your main site uses the new-style http://{{zone apex}} as in [1] with a TLD like .io, you can get different results depending on whether someone hits your main site first or your Marketo-hosted LPs!

Bottom line: must set your domainLevel if you are using any 2-letter TLD, should set your domainLevel always.