Never ever ever use robots.txt to prevent indexing.
Robots.txt is only for preventing crawling. Rather detect bots from the user agent and throw a 404 header with a die and include a meta noindex as well just in case. Facebook recently got millions of secret URLS indexed in Google with emails in them - and yes crawling was blocked with robots.txt.
Returning a noindex meta or header should be enough for the honest crawlers, if your worried about dishonest crawlers then your fighting a loosing battle and have a different problem all together.
But what if you don't want to waste server resources in bots crawling thousands of meta noindex pages? Perhaps you are using some heavy SQL queries on those pages.
You can block crawling with robots.txt but then Google won't see the noindex and URLs will be indexed.
If you block and send a 404 to bots I think that's fine. They will see a blank page - nothing to gain from that in ranking. So cloaking, perhaps yes, but I don't think it would be risky.