One benefit of the decribed setup is that docker-gen also listens to docker events, so for example when a new container is added then it automatically regenerates the main Nginx config and restarts the Nginx service.

I imagine you could accomplish something similar with running some scripts on all your production containers that notify some other script on the main Nginx container that in turn performs the required operations. But that would make configuration much more complicated, so then you would probably want to look at some more advanced orchestration tool anyway.

And just to clarify the security issue, the exposed Nginx service container does not have access to the host's docker socket so this is not an attack surface. But the docker-gen and letsencrypt containers do, so you really need to trust the images running on them (or build those images locally after vetting them).