I'm going to confirm everything you said and I'll give you some specific examples.
How to pull code off a board: on most arduinos, the bootloader will let you pull ALL of the values from flash, eeprom, fuses, etc. Let's say you dump the flash (bootloader + program). This is done easily with the AVR tools in the arduino IDE. Specifically avrdude.
Every single change to code for the application will give you a different checksum on dumped board firmware. There is no way around this if your variables are in the program. The solution to this is to have a list of known, good checksums - a list of approved variations. This is directly applicable to the hax arduino mod, you'd need to keep a list of known, approved configurations in that method.
You can dump the code from a board but you will get straight assembly. You won't be able to check it for illegal functions by hand, you would need tools to convert it into a readable form and even then, most TOs aren't programmers. You can't realistically expect a TO to open a controller, plug the arduino into their laptops, dump the code and then read it. Each of those is kind of a mountain in and of themselves, and definitely not tournament-practical.
Let's say we live in the goofy world where a TO can look at the source code directly going into the board. Say a guy opens his controller, a TO looks at his arduino sketch source code, and then hits the upload button. You don't have to be too sneaky to get things past here - you can simply hide spooky code in any of the libraries you use, keeping your sketch looking perfectly innocent.
The end game for cheats will come in the form of invisible triggers. Triggers will be made in such a way where they activate upon a specific key sequence, and then pull off a macro to finish the sequence. This will be invisible in Smash just like it's invisible in Counter-Strike. You can't catch this by watching a player's hands, recording his inputs or examining a replay.
Ok, so let's say cheats have a trigger? Where is this applicable in the game? Auto-execution of true combos. A player can begin a true combo, the arduino can disable his further inputs, finish the combo and then give the reigns back. If it's something a player would normally hand 95% of the time, now they can get it 100% of the time.
Cheats will be subtle, and will still require a player to play the entire rest of the game. It's going to matter only at the actually competitive level because these kind of cheats will close the execution gap.
Can this be made to work? Yes, but changes will need to be made. Simply put, there isn't a practical way to check it the way they have these now.