Why did I encounter cards from a higher arena from my opponent?

I was playing 1 v 1 in arena 5, but a player whose trophies are lower than mine put out a bomb tower card from arena 10? Is this possible? Is he really a hacker? We can't demote in arenas anymore, so how could this happen? And no, this card isn't a legendary.

No, he is not a hacker. Bomb tower is one of the many cards that changed arenas in the 20/6/18 Update. Bomb tower actually used to be in Bone Pit (Arena 2), but it was moved to Hog Mountain (Arena 10) in that Update. When these cards were moved, you still kept all the cards that you had, even if you were too low arena to unlock it post-update, and you could still even obtain the moved cards from chests, even if you weren't in the right arena! For example, Sparky was moved from Arena 6 to Arena 11 in the update. I had gotten a Sparky by then, so I kept it, and I could still unlock Sparkies from chests even though I wasn't in Electro Valley. Same goes for Rage. I had Rage lvl 8 pre-update, and I could still get more Rages even though I wasn't in Arena 10+. However, a new player couldn't get Rage without getting to Arena 10.

Your Bomb Tower-using opponent had obtained his Bomb Tower before June 18, 2018, in Bone Pit, then I'm guessing unlocked some more from chests and used it on you.