A few (semi random) thoughts regarding the use of the Hexic Flash player
Just because the HexicDeluxe demo is coded as Flash engine & Flash file, that doesn't necessarily mean that the full downloadable version is. These files could be an early proof-of-concept/prototype/demo. The full version may be a more common compiled XEX. (Historically Macromedia Authorware & Macromedia Director are commonly used to prototype applications ahead of full development - which can take place using completely different toolsets).
If the full version is still Flash, just because HexicDeluxes developers decided to publish their app as a Flash Player & Flash file, that doesnt necessarily mean that all XBL Arcade content is also limited to Flash (after all, the binary Flash player XEX would still need to be included in the downloads). They may have already had Hexic implemented in Flash, so porting a Flash interpreter may have simply been more efficient. If it was
newly developed, developers experienced with Flash ActionScript would be easier to find than X360 developers (and cheaper). Hire one C++ programmer and 20 AS developers! (Given the strength of this model, maybe M$ themselves put together the Flash Interpreter as an option for Arcade content developers?)
Isn't there a full HexicDeluxe downloadable from XBL? It may come with a
more complete Flash player

- although its XEX may be media flagged to execute from HDD only!

IIRC tools now exist to allow the extraction of X360 HDD content for examination.
A few (semi random) thoughts.

I'm thinking the flash player already resides on the HDD when you get it and is more capable
the point you seem to be making is vaild. However I think what is trying to be attempted is not to run something from the HDD (though obviously that comes later) but to use this disc and a custom flash file to find out more about the 360's security and files, no? So it doesn't matter all that stuff