I amended my above comment to note that the official WordPress distribution channels are not necessarily the ones that are most at risk for this. And for what it's worth, the rationale given in those guidelines for banning obfuscation is that it is not GPL-friendly--not for any security reason.

It's not a total ban, either: "However, note that some systems, like Paypal donation buttons, use encoded code as part of their normal operating mechanism. This is not considered to be 'obfuscated' as this is simply how these types of systems operate and it is not a choice by the plugin author."

That seems like a reasonably-sized loophole.