It would not be possible for another piece of code to modify arg during the execution of elmModule.f since JavaScript is single-threaded. However, if elm code keeps a reference to the json Value, it is possible for two decodings of the value to produce different results if some non-elm code runs in between.
In a normal elm program, this is a possibility (and is actually sometimes useful), but I don’t know enough about your code to know whether it is a possibility in your library. Does your library ever keep any state, or in other words does your library allow wrapping Program types? If not, then it should be safe.