I had the same experience, and finaly give up.
My advise is: don't try to fix something yourself, or make changes.
We put 2FA on our systems, have DNS-config on a seperate server, point php open_basedir to the users public path and I stripped the graph on the userpanel of projected traffic.
But after every update most off my changes where overriden or something else didn't work at all.
Right now we see that certificates are being created allthought "Automatic SSL generation" is off!
I've also tried to fix things myself but with encoded php-files it's hard to do.
Then I submitted broken items into the bug-system but this wasn't working as well.
So I ended up with a big cheat-file, and a cron on another server that checks if some things still work.
We had 10 Cpanel-servers, and after migration of the first 2 to CWP, we migrated the others to DirectAdmin (which works much better)