Some of this comes down to "When does Listing matter?" For the most part, the only time anyone cares about listing is on the initial installation when that installation is done with a permit and inspected. Once it is installed, is anyone going to pull a permit and have an inspection just to add another circuit to a panel? Not likely (unless it is a smaller part of a larger project). So yes, panel listings get "violated" all the time AFTER they are initially installed. It MIGHT matter to an insurance company, but only after the fact in the event of an accident that involves a claim. An insurance investigator might notice an alteration and investigate what the original panel was designed as, then the after-the-fact modification, having violated the original listing, would be grounds for not paying on the claim IF they could prove that was the cause of the loss. There are a lot of IF's in there however.
Back to the issue though; there are likely OTHER NEC related things worth looking into here, such as SCCR listings if the branch circuits that they add are in the Power circuit, or sizing of the Main after adding more branches, or proper adherence to Tap rules, etc. I find that when people do this sort of thing willy-nilly, these are most often the things that get violated.
Breaker panel mfrs make what are called "Mini Power Zones" (which is I think Square D's name for them), which is a potted outdoor transformer and a small load center in a common enclosure. I have, many times, hung one of those off of the back or side of a control panel as a way to provide additional local branch circuits. The primary for that transformer is inside of the panel, but if you need to access the branch breakers, they are on the outside. Solves the SCCR issue and isolates those branch circuits from the control panel power so that if someone plugs in a table saw in the field and it trips the branch breaker, you don't have to turn off the control panel main to open it up and reset it.