Since the bootloader is locked, we cannot have a true "custom recovery" where the actual recovery is replaced. Right now there is a facsimile of that where the boot process is hijacked, but it's still not a real custom recovery partition.
Since there is no custom recovery partition, the kernel cannot be replaced.
That's about it. Just about everything else can be replaced: the "guts" of the OS, so to speak.