So this is completely undocumented as far as I can see, but for some reason, if you return raw HTML from the "_ClientArea" function (instead of the usual array of template name + variables), it's rendered in the "addons" tab of the client area.

Would have been nice if it was consistent with the product/service behavior though. Since it's not consistent, you'll need to detect whether it's an addon or a product before deciding to return the "template name + template vars" or the "raw HTML".

It seems this can be done with if ( ! empty($params["addonId"])) {/* This is an addon, not a product. Return HTML instead of template + template vars */}