Why does PCIe hotplug capability require hardware support?
Software-wise, it makes sense, since the OS has to re-scan the bus, and by default it doesn't do this after the initial scan.


Nah. PCIe is a point-to-point network much more than a bus that needs to be scanned. But you're right, something in the OS needs to be able to handle the info coming from the PCIe bus master that topology has changed.

Also, your OS needs to be able to deal with new memory regions being mapped to new hardware and so on.


  Hardware-wise, I do imagine it would require special circuitry in order to send an interrupt to the CPU, so that the OS is informed about a new device being connected to the bus.


Hardware support not only means that (that functionality is pretty certainly there in every PCIe bus master implementation through the PCIe standard), but also simply routines in the PCIe hardware's firmware to initialize the new link etc.


  How does electrical current flow differently from when the PC is turned on after the insertion?


That's kind of like asking why you can't insert a RAM bar when your system is already running: Electrical connections are sensitive things, and plugging in something "takes forever" and does all kind of weird stuff (ringing etc) on the freshly connecting signal and power lines. So, your hardware and connector need to be designed in a way that makes sure not to e.g. power up ESD-sensitive pins while the connector is still mechanically handled (because sudden disconnections, like they always happen when you make a mechanical contact) will lead to voltage spikes, and obviously, while you're still "scratching" metal against metal, the link will be so unreliable that all signal carried across this will be broken.

Hence, your design must make sure to only power and initialize the device after the necessary connections have been securely made.

On hot-un-plugging, things are even more dangerous: you need to make sure not to damage host and PCIe device by letting the host know things are going to disappear from the bus in a couple milliseconds, by making sure you sever the connections in a sensible order, and by making the link electrically safe to disconnection.