However, this validation was lifted, at least for canvas app. The only way I found that out was through a comment by @caburk under this idea. There is no documentation for this change, and Microsoft still defines the managed solution components as un-editable.
This changes goes against the definition of managed solution and is very frustrating. You pretty much cannot sell your solution that requires a canvas app without leaking you code. This should be a future update, especially after this ideais completed as this will allow us to protect our IP.