I think any option that changes the binary packet format would need
to be included in the kex hash to prevent downgrade/upgrade attacks.
This is somewhat annoying implementation-wise if it is a separate
packet.
Is there any way of doing some sort of pre-auth to prevent tampering
with the options packets?
You could simply decree that options packets for the option in question
are not acceptable if sent before the first kex completes. (I'd
hesitate to do that for all options packets, but it may be necessary.)