Unless I misunderstand, if your device is a true clone, then there should be no *practical* issue using the Arduino vendor IDs (ethical issues are another matter, of course). There no chance of a "collision" of any kind occurring -- you *want* your unit to identify to the system as an Arduino device in order to use that driver.
Yes, technically that would work. However, it's a little like copying the key for a rental car, then helping yourself to the vehicle whenever it's on the lot.
So really it just boils down to the "theft" of the IDs. Has Arduino ever complained or made their position public on this point? Does the vendor (Arduino) even have the option to allow "sharing" of the ID if they so wanted under the terms of their agreement with USB Forum (if that's the licensing body.)
The way I understand it, no, they don't have this option. The vendor ID is assigned to you as vendor, and TTBOMK it is not permitted to conspire to allow others to use your vendor ID, or to distribute product IDs to other entities.
Finally, suppose you've developed clone hardware and you *want* it to run using the device driver written by another manufacturer (e.g., Arduino) as described above. Is there a mechanism to do that, apart from spoofing the Vendor ID on your hardware?
No. If you spoof the vendor + device ID of the original part (which, together, I call the product ID -- that may or may not be officially correct), you're basically stealing that from the licensed vendor. No one's going to care if you do this on a DIY clone for your own use, but the minute you sell that product, it's likely you'll be reading a cease and desist letter soon. The original author's driver will not acknowledge your compatible device with a different product ID, so you would have to provide your own driver. That's not a big deal, but it does mean that it's not an exact clone anymore -- it's essentially a different device that performs the same function. That's splitting hairs somewhat, but if your users have downloaded and installed the Arduino software, an actual Arduino just works. Your "clone" would also require its own driver to be sourced from your website or included media (yeah right).
I got a little academic with all that talk about device ID collisions before. The gist is, every vendor gets their own vendor ID and due to the threat of device ID collisions (and it being a breach of licensing terms), only the licensed vendor is allowed to use that vendor ID. I should've worded the ending better, since using the same vendor and device ID wouldn't be a "collision" per se if it was meant to emulate the original device, but if a device manufacturer stole the vendor ID and made up device IDs from ones that weren't used by existing devices (for example, using the Uno device ID + 1 or whatever to identify "Brand X Uno Ultimate"...) then you run the risk of collisions. Sorry for the confusion.