I have been thinking about why it was that Arminius returned to his people from Roman service shortly before or around the time Varus took up office. If, as it widely believed, Arminius and his retinue campaigned as auxilia in the Pannonian or Illyrian campaigns under Tiberius, it's interesting that he and his troops returned to Cheruscian lands at around this time. I'd say it's reasonable to hypothesise that, with Bato on the back foot and the rebellion north of Italy under control, Augustus thought it wise to move some troops back to Germania and took the opportunity of Varus' appointment to re-inforce the legions there back to something like full strength.

As you say, five legions is a very small force to hold the territory they were guarding and to have them seriously under-strength would have been dangerous. Perhaps Arminius' return is an indication that units moved from the Rhine and the fledgling province of Germania to the Dalmatian theatre were being transferred back to support Varus' new mission east of the Rhine.

So perhaps we need to revise your figures back up a little.

That said - we know from Dio that Varus' three legions were certainly depleted by vexillia scattered through the countryside guarding fords, markets etc. And if, as you argue, the legions weren't at full strength this would have made them a slightly more vulnerable prospect than they would have been otherwise.

Many people dismiss this battle by saying "well, the Germanics caught them by surprise and that's how they won". That surprise would have lasted for the first hour or so at best (if that). This battle lasted for three to four days. So after the initial surprise wore off there were still up to four days of hard fighting, which means Arminius must have had been able to raise a substantial number of men.

His auxilia and the other Cherusci in Roman service would have formed the core of this force, but these alone would not have been anywhere near enough to take on a Roman force of 15-20,000 troops, no matter how awkward and adverse the conditions. We know that the Romans were able to form up and counter-attack at least twice (on the second day and in the Last Stand), so to imagine that a few thousand mutinous auxiliaries were sufficient to defeat Varus' army is fanciful. Arminius must have raised a force of over 10,000 warriors and native auxiliaries to have achieved what he did.

But if Varus' force was at full strength even this number (which in itself would have been stretching the resources of the Cherusci and their allies) would have struggled to achieve victory. Their success makes more sense if Varus' troops were not only depleted, but under-strength to some extent to begin with.
Cheers,
Thiu the Venerable