It applies to all services which are managed by Pacemaker, including the associated virtual IPs. The same services that can be separated from the Pacemaker services are the ones that can be moved to other roles and don't have the same scaling constraints. For instance, you could probably add X additional API worker nodes in a custom role, and they would be added as back-ends behind HAProxy, but you couldn't add any HAProxy nodes, since Pacemaker manages the virtual IPs that HAProxy binds to. Unfortunately, Pacemaker manages Rabbit MQ, so you are stuck with 3 nodes.
--