I've heard mixed things. If I have an app that primarily uses Salesforce Canvas to operate, is that required to go through the security review? Does it perhaps depend on if it's a managed package vs. non-managed package?
There's no technical requirement for Canvas Apps to be approved. In fact, there are very many private canvas apps used by many organizations that are not approved. Many canvas apps are created as a bridge between salesforce.com and some legacy system or other integrated platform. You can choose to have it approved if you want to list your canvas app on the AppExchange publicly.