Can customers trick their way into a bigger discount?

No. Checkout independently re-checks every bundle against your published campaign — the products, the counts, the gifts, the rules. Anything that doesn't match simply prices at full price. Customers can never pay less than a campaign allows, and checkout itself is never blocked.