Is the "hard" memory controller a hardware block or just programming?

It depends on your target device family. Cyclone V and Arria V, I believe, were the first to have hard memory blocks (hard PHY with soft controller). Arria 10 and Stratix 10 have hardened PHY and controller.

What is the difference between "hard" and "hardened" in Altera-speak? In programming, "hardened" usually has to do with security and/or fault- or interference-tolerance.

Hard or hardened means the same thing. It means that it is a fixed structure in the device, like an ASIC as you mention. Even hard IP, though, does have some customization usually possible.