To clarify about the DS Action Replay, it has two different functions. One, it acts just like a normal GBA Action Replay with cheat codes (except some codes won’t work on it); and two, it can transfer both GBA and DS saves from the game to your computer. It is NOT capable of using codes for DS games, however once the DS save is on your computer you can then manually hex edit it as the codes would automatically. Of course, hex editing can be rather difficult, especially since there is no DS emulator.
That does not mean that hackers will not exist on D/P WiFi. Just take a look at Animal Crossing; I’m not sure how much of a problem they are right now, but back when I was playing a lot there was this hacker who would hold giveaways of unobtainable items on GameFAQs. The method of hacking he used involved a custom made GBA ROM that he put on a GBA flash cart and that acted pretty much in the same way as a true DS Action Replay would, except without having to meddle with codes.
Of course, it will take a while for hackers to figure out how D/P works in order to create a hacking utility like that, but of course it will happen. And, in all honesty, I don’t really care. I’ll probably need to rely on hackers in order to get a Manaphy and other rare Pokémon that otherwise would be unobtainable for me (since I can’t go to events).
Another thing to keep in mind about hacked Pokémon is that, despite the common belief, as long as they are hacked within legal stat boundaries and any “obedience bits” that GameFreak might have thrown in (as they did with Mew and Deoxys) in to attempt to throw off hacking attempts are set to on, there’s virtually no way to detect whether a Pokémon was hacked or not. The problems arise when hackers start giving Pokémon outrageous and impossible stats, say that they’re from some place in the game where you can’t normally obtain that Pokémon, etc.