I've found an issue in v2. Editor can create content inside noncontainer locations. This wasn't possible in v1. Create button should be disabled in that case.

This action is also allowed by the kernel. I highly believe it should be enforced there as well to avoid getting dirty data from REST and PAPI.