I would guess these plugins are chosen so a majority of user won't want to live without them.
It also seems these plugins "link" to canvas-lms, so keeping the proprietary would be a GPL violation if anyone except Instructure holds part of the copyright to Canvas.
I got tired of dealing with SSH knocks and blocked the port for all external IPs, using WireGuard to get into the LAN.
WireGuard is nice because, unlike most other services, it operates on UDP and sends no reply packet unless you know the key, so attackers can't discover it by portscanning.