"Mask-on by default" means no regular user will ever uncheck. I think you greatly overstimate people's security knowledge, not to mention UI.
By default, the masking would be enabled. All you see are "*".
If however, you have some nasty password and you are in a safe location, you can do_action and turn off stars to "12345".
As a security expert, you should provide what's more secure, even if that means recognizing the users are too dumb to follow your rules.
We're into untested territory thinking here, and I don't believe calling for statistics will disprove anyone. In the absence of hard numbers, I take your challenge.
staunch, I bet you $25 (via PayPal) that two users will not uncheck password masking off, when presented with an explanation what it's for, without looking either to the left, right or behind before typing the password.
I'll probably try this on one of my sites (I've tried no masking before). Maybe I'll blog it. You can keep your $25.
So what is the harm there? Even if a user could not figure out (oddly) what the checkbox does, he'll continue to get the password field to behave in the way he is accustomed to.
Surely, people will have trouble figure out the purpose of the checkbox in the beginning. But that's how things tend to be when you run into something for the first time. It takes some time before a style becomes standard.