They CANNOT add updates in this fashion to add whole new pokemon and stuff. The main thing everyone forgets is that the 3DS is not physically capable of rewriting game code on a physical cartridge. Technically such a thing COULD be possible if there were no physical games and it was all digital (Nintendo would simply release a new game that would overwrite the old game, the same way iphones and ipads replace the apps on your devices when a new update comes out)
Updates, that they have released so far, are to fix programming errors. (when this 1010010101 should have actually been 1010010100, in the most basic sense) things like the Lumiose City glitch and the secure wifi are basically fixes to the hardware or how the hardware interprets game data (depending on the fix) which CAN be rewritten because nintendo is fixing, changing or adding coding into the firmware of the 3Ds which CAN be rewritten by the 3DS. The game cartridges cannot be rewritten by any consumer video game system, and nintendo is not going to change the game for the digital owners only if they can't make the same changes for the physical game owners. Like Cyclone correctly pointed out, if it's not in the coding now, it won't be for this generation. (case in point, the hacker that found Hoopa, Diancie, Volcanion, and the Mega Latios and Latias. And just because he couldn't find the locations of the other unreleased megas in the game doesn't mean they weren't in there. Look at the shiny forms of Xerneas, Zygarde and Yveltal, the hacker didn't initially find those at the time he found the other legendaries or mega evolutions, it took someone to find the various values and input it into another program to find the estimations of what they thought the shiny forms could look like, and it took months upon months until they finally found out that yes, the estimation was in fact correct and were able to implement them into (I think) the power save system. If the coding was so easy to find, they would have found the shiny forms of the X Y Z trio IMMEDIATELY, not MONTHS later. So if the shiny forms were that hard to find, obviously the mega forms of other pokemon could be hard to find as well, particularly if they were placed in a different memory location from the Kalos Mega Evolutions. Heck, for all we know there could have been a lock in the system that prevents access to the mega forms at all until there is some interaction between the Kalos games and the new Hoenn games before those memory locations can be accessed at all, only Game Freak knows at the moment. After all, if the hacking apart of the game was so utterly complete and thorough, they could check to see what the Lumiose Ghost Girl is actually checking for, or find alternate text for her to see what the deal is. )
