So they have to update the smart-contract in order to block the addresses? What if there were so many addresses that the smart-contract can't hold them all? Is there a limit on smart-contract size? Or maybe the smart-contract can call out to ask the Tether server if it's okay?

What gas-fees is Tether paying to update the smart-contact with a new list of banned addresses? Less than the amount of dollars cancelled I guess, but need that be true? Is there a hack here to get enough addresses banned they have to lock up the blockchain with banning addresses?

I think you answered your question. They can just call an API to see if an address is banned. It's easy peasy when it's centralized.

🤔 Seems hardly any point in it being on-chain at all then if every request to move one ends in a call to a central Tether server.

Yes, it's decentralization theatre