Explanation
The admin should create separate business units for each of NTO's brands when brand-specific private domains need to be leveraged when wrapping images and links in email campaigns. A private domain is a domain name that NTO owns and uses for their email sends, such as email.nto.com. A private domain can be used to wrap images and links in emails to improve deliverability and branding. However, a private domain can only be associated with one business unit in Marketing Cloud, so NTO needs to create separate business units for each brand that requires a different private domain2. The other options are incorrect because:
* NTO requires SSL certificate configurations for Content Builder and Portfolio images. This is not a reason to create separate business units for each brand, as SSL certificate configurations can be applied
* at the account level or the business unit level. SSL certificates are used to secure the connection between NTO's web server and their subscribers' browsers, and can be applied to Content Builder or Portfolio images to ensure they are delivered over HTTPS3.
* Multiple brand logos must be accommodated in an email header. This is not a reason to create separate business units for each brand, as multiple brand logos can be accommodated in an email header using dynamic content or AMPscript. Dynamic content or AMPscript are features that allow NTO to display different content in their emails based on subscriber attributes or data extension fields4.
* A new sender profile needs to be leveraged for sending transactional emails. This is not a reason to create separate business units for each brand, as a new sender profile can be created and leveraged within the same business unit. A sender profile is a configuration that defines the sender information for an email, such as the from name, from address, reply address, and sender classification5.

Explanation
Business unit unsubscribe setting causes an Enterprise level unsubscribe is what could explain this behavior.
Business unit unsubscribe setting is a setting that determines how unsubscribes are handled across different business units in an account. If this setting is enabled, when a subscriber unsubscribes from an email sent from one business unit, they will also be unsubscribed from all other business units in the account. This is also known as an Enterprise level unsubscribe