A damn good post, this! I have a point to add to this, but first I'd like to make a few corrections:
First off, all we've really heard from insiders is that they simply haven't heard of anything regarding these. They haven't outright said they were fake, the just don't know. And second, there have been some working Mii hat mods in response to the CacoMallow post:
View attachment 253350
The size issue is still a thing, but it's perfectly possible to make working Mii hat mods.
Anyways, I wanted to add to your initial point right here:
A lot of people tend to take for granted how much risk there is with this leaking thing, and how easily it is to be discovered, fired, and disemboweled by the Nintendo Ninjas, especially if you're leaking things yourself via 4chan. This is amplified even further if you're leaking particularly juicy info, as Stabby found out when he got CnD'd before he could leak the E3 Direct. If you're going so far as to leak stuff under Nintendo's round, moustache-clad nose, it helps to not also royally piss them off in the process.
This leads me to the CacoMallow post. A lot of people have been wondering why whoever leaked this (assuming it's real, which I think and will say for the sake of argument that it is) didn't go further and show off Geno, Doomguy, Dovakin, Terry (who hadn't been released at the time), etc., instead of just some Mii Costumes. Well, I think it's rather simple: He didn't need to. I believe that the Mallow and Cacodemon hats were chosen specifically because of their very unique quality of being able to both convey some really juicy info whilst also being plain enough and having just enough plausable deniability to minimize risk for the leaker and keep them off of Nintendo's radar.
The CacoMallow post appears very ho-hum as far as leaks go, especially compared to what we've got for Ultimate thus-far. All it shows is two fancy-looking hats and nothing else. I mean sure, one of the hats is from an american company not currently affiliated with Smash, but it still doesn't outright reveal anything else. On the surface, it's not all that bad. But dig a little deeper and get your noggin' joggin' a beat, and it's meaning becomes crystal clear. It's pretty obvious that this is hinting towards Doomguy (or any other Bethesda character) and Geno coming to Smash post-Fighter Pass. I mean, unless you had some other outcomes for Geno and Doomguy in mind (which have their own flaws in logic if you ask me), it's pretty hard not to see this as anything other than a hint.
Now you may be wondering "Well, Nintendo clearly aren't that dumb to overlook this post assuming it's real, so why didn't they just take it down?". Well, consider how the leak's been regarded with the community: Most people who've heard of the CacoMallow post have either dismissed it as a mere mod by some talented Artsi Omni-tier troll, or have completely forgotten about it. If that's the case, there's really no reason for Nintendo to waste time worrying or doing anything about it, since as far as most people are concerned it came and went like a fart in the wind. Nothing ventured, nothing gained. Not that they really
could do anything about it since any action on their part, such as flagging any videos showing the leak or talking about it, would be taken by most as a sign that it was legit, drawing unnecessary attention to it that they clearly don't want.
Furthermore, consider when the CacoMallow post first dropped. Consider what was also happening around that time. That's right, the Pokemon Sword & Shield Leaks. Compared to that whole kerfuffle the CacoMallow post seems like small potatoes, which would allow it to better pass by undetected. Of course, Nintendo can totally keep an eye on both situations, I'm not so dumb as to insinuate they can't walk and chew gum at the same time here, but I wouldn't doubt that something like that would certainly aid in the CacoMallow post slipping by relatively unknown. I'm also not saying that it was planned that way, either.
Either way, I believe that it's no accident that the CacoMallow post was presented in the way it is. Hell, I'd even go so far as to say it's downright ingenious. Forget slipping past the radar, it's practically hiding in plain sight. So unremarkable-looking that most will dismiss it, so clear that it's easily understood by it's recipients, but just sensitive enough to stay any action on Nintendo's part, meaning they can't do a damn thing about it lest they spoil the suprise. If this turns out to be legitimate, I think the CacoMallow post will go down in infamy as one of the best leaks in all of Smash. It's not very showy or dramatic, but at the end of the day posting potential Smash leaks isn't about being flashy, it's about sending a message.