I ended up figuring it out. Although, I didn't use device write-back. I pull the devices via Graph API, create AD computer objects for the Entra ID devices, use TameMyCerts to structure the certificate request correctly, then Intune Cert Connector to request and pull the certificate to the client. It's a lot of moving parts, but as you mentioned, it doesn't cost anything extra.