IoT Certification Legality
I contacted a testing lab and they explained several details to me.

I do need radio certification. This certification is called IC (Industry Canada). I should use a cellular module in my product that already has radio certification. This way I can leverage their certification (provided I use an antenna with the same or less gain and keep the device above 20cm away from people) with an "IC Contained" label. However, I will still need to do EMC testing even if I'm "IC Contained". According to the ballpark figure for this lab, that costs about $3000.

If my module is just FCC Certified that is bad. Although FCC and IC have large overlap, I would be responsible for filling in the gaps between the two tests for the module. Probably out of my budget.

In terms of pure safety tests, I am still not certain. It 'seems' like a CSA (Canadian Standards Agency) test isn't legally required. But it's recommended for marketability.

I will try to talk to someone who has been through this process already in Canada to get more information. I may update this answer when I know more.