Compliance Testing Strategies
You're definitely on the right track with:


  I tested the product in these configurations, and they represent a superset of all possible configurations, and they all met the regulatory standards; therefore other hardware configurations and firmware updates in the same family are compliant, no more testing required.


Having worked at UL for a few years, I can speak to it from the safety side, although I don't have experience on the EMC end. This wasn't an uncommon way of testing these types of modular designs. What you'll want to make clear is how these systems can be put together; i.e. "The end product will use one of these 5 power supplies, one of these 4 I/O modules, 2 of these XYZ widgets, and up to 4 of these ABC widgets."

Then, what you try to do is put together a "worst-case" end-product; the one that deals with the highest voltage, current, and overall power. Maybe this is one combination, maybe its a couple.

Then, the testing is representative of the entire set. Again, this was very common. My advice to you would be to propose your own test plan, explaining why the ones you chose are worst-case. Make it so the testing engineer only has to say yes, rather than try to choose on their own. 

Hope this helps on the safety (fire and shock) side.