Is there any way someone can hack in and get the free items?

Product Upsell does checks to ensure that the user's cart qualifies for the offer before allowing customers to add a free product. However, it is not (and can never be) 100% foolproof due to the way Shopify accepts products. The app does offer a limit disclaimer function that should remove your obligation to ship products that the customer does not qualify to receive.

Blog Posts: