Is updating the composer.json file & consequently composer.lock in Drupal 8 considered a good practice or hacking the core?
Modifying anything in core is generally not recommended.
Unlike other projects that use composer, Drupal already has its composer packages included in core/vendor and you are not supposed to change them, nor the composer.json. Updates to Drupal 8 core would wipe your changes.

There is a module Composer manager that will open a second vendor directory in sites/sitename/vendor (I think). There is some discussion going on in the issue queue, e.g. Is it okay to have duplicates of symfony, guzzle, etc... in sites/all/vendors?. I imagine a future where sites/sitename/vendor could replace core/vendor. But we are not there yet.

I think you should participate in the composer vendor issue queue, this is all work in progress.

EDIT:
It should be mentioned that the way Drupal 8 is using Composer is not the way it is recommended. The recommended way is that the user should download Drupal and vendor packages via Composer. Instead, it is all pre-packaged. One reason for this is to support shared hosting where you don't have a commandline available, and just want a complete package to upload.