You may dynamically change contents of the GATT database while connected. GATT service and GATT "Service Changed" characteristic will be used to notify client of such changes ([Vol 3, Part G], 7.1).
Hiding service before bonding does not add anything useful wrt having a service with authenticated access only. In both cases, you'll need to bond to use it, but managing access rights rather than handling GATT db change is better tested in implementations (if supported at all).
So yes, in theory, you may change service exposed in your GATT db once bonded, but I'd rather not rely on it.