Hi,
You are not taking the wrong approach, and both problems you found are real. We have fixed them in HikaShop, so the two core edits you had to make are no longer needed, and we have also published a free plugin that does the HMRC check, in case you would rather not maintain your own:
www.hikashop.com/marketplace/product/314...at-number-check.html
On the GB prefix: that line was written when the United Kingdom left the European Union. Only the numbers of the Northern Ireland protocol, the ones starting with XI, are in VIES, so treating every United Kingdom address as XI was the only way to check anything at all. It was wrong for everyone else, and the message even told your customers to type XI, which is not their number. Both prefixes are now accepted for the United Kingdom, and a number typed without a prefix is given XI when the post code starts with BT and GB otherwise, since Northern Ireland is not a country of its own in the address form. A GB number then reaches the online check, and since VIES cannot answer for it, HikaShop leaves it on its format check and writes a line in the log instead of refusing it, which is what it already does when VIES is unreachable. A plugin answering on the trigger takes over from there.
On the trigger: you are right, and your fix is the right shape. triggerEvent returns one answer per plugin, so the array was handed back as the verdict and array(false) read as true. It now refuses the number when any plugin returned false, accepts it otherwise, and displays the message you left on the object, the way the VIES branch does. So if you keep your own plugin, set $processed to true, set $obj->message when you refuse, and return true or false.
Both changes are in the 6.5.2 published today, so download HikaShop again from your member area before installing the plugin. If you want to be sure of what you are running, open the configuration page of HikaShop and the version number at the top of the Main tab should read: 6.5.2 [2608261812], and the ten digits in the brackets are the date and time of the build.
What our plugin does, which may save you some work either way: It answers only for GB numbers of 9 or 12 digits, so the numbers of the other countries and the GD and HA numbers of the government departments, which the API does not hold, keep going to VIES. A 404 refuses the number, a 400 refuses it as malformed, and anything which says nothing about the number itself, expired credentials, a 429 or a 5xx, follows a setting which defaults to accepting rather than blocking your checkout. The access token lasts four hours and is stored with the settings instead of being fetched on every checkout, and a token revoked early is renewed on its own. If you enter your own VAT number in the settings, it uses the verified lookup, so HMRC returns a consultation number proving you made the check, which is written in the log with the name and address it holds.
One thing to plan for: version 2 of the API is behind authentication, so you register your own application on the Developer Hub of HMRC, subscribe it to the "Check a UK VAT number" API and accept their terms. That takes around two weeks.