Consider a Contract:
Contract Example{
uint array[];
address owner;
function Example(){
owner = msg.sender
}
function setArray(uint index, uint value) public {
if (msg.sender == owner){
array[index] = value;
}
}
}
Is there any possible that hacker update array[] directly by generate a specific block. (steer clear of the condition that "only owner can update array")
Anything's possible.
But assuming the basic security of the blockchain is intact, no, nothing but the smart contract itself is allowed to modify its storage.