One thing I'm wondering is how the SNES implemented its Multitap support[1] with such a simple "wire protocol". Could it be that the two missing wires and/or 4 unused slots in the polling cycle are used for some kind of adressing scheme when a multitap is plugged in?
The video below goes over the controllers, Super Scope, mouse, etc. A brief discussion of the multi-tap starts around 16:00. You are correct that it leverages the spare pins.
[1] https://archive.org/details/SNESDevManual/book2/page/n385/mo...
[2] https://www.downtowndougbrown.com/2013/04/homebrew-snes-4-pl...
The IR wireless one was, in my experience (it was the only one I had) far less janky and failure-prone than one might suppose. Actually worked quite well.