hubs cannot insert data. the only function a hub serves is to assert that there is new data on the feed, and that clients should re-request the feed.
a malicious hub could continually signal clients to keep fetching the feed, triggering a Denail-of-Service on the feed. that's really the only possible mis-use.
hubs can also proxy. ycombinator could run their own hub that could subscribe to someone else's hub and notify by proxy all of it's clients. this negates a lot of the "big hub" mumbo jumbo you seem to fear.
to answer your original confusion, the problem PubSubHubbub solves are two fold. foremost, 5 minutes is a long time in some worlds. second, every client subscribing has to pole every 5 minutes, asserting an etag and/or if-modified-since, which the server then has to look at and validate. with pubsubhubbub, results are "instant" and the server doesnt have any load when nothing new is being posted. this is indeed a big deal.
to your last, a micro hub will have no additional load, so long as the micro hub has any subscribers.