To be honest, I don't think getting the license from Disney is the real issue here.
I think the REAL issue with Sora is...Nintendo might not even consider him a video game character. Which is the only "rule" that I think still holds in Smash.
I'll use another character as an example, Android 21 from Dragon Ball FighterZ. 21 is a character that first appeared, was created for, a video game. But Android 21 still wouldn't count as a video game character, because she's still a Dragon Ball character. And Dragon Ball is a manga/anime property first.
Sora's situation MIGHT be considered the same by Nintendo. Yes, Sora is an original character created for the video game series Kingdom Hearts. But a lot of what Kingdom Hearts is, is an adaptation of Disney movies and cartoons. And whether Nintendo considers KHs an original video game series, or an extension of Disney's movies/cartoons, would determine whether Nintendo even considers Sora to be a video game character, or just an adaptation original character like Android 21.