Managing the Service accounts in large environment
A separate AD service account for each service on each instance is the most secure model and if you have some good password management software it shouldn't be a problem. The work involved in creating all the service accounts and entering them into your password software will be quite time consuming depending on how big your environment is.

Some people sacrifice some security by using the same service account for all the services on a SQL instance. The problem with this is if the account gets locked out then all the services including the SQL service account will be locked out. This problem becomes even worse if you use the same AD account across SQL instances as one instance can be affected by another. Also obviously if an account is compromised, the more services it is used for then the more services that are compromised.