I wouldn't describe user agent cloaking is bad or harmful. It's simply not as secure as IP cloaking for the reasons you mentioned.
Any SE can penetrate any cloak by simply surfing to a site from an "unknown IP," in other words masquerading as a typical surfer, and comparing the site's code to the code their spider retrieved. That's a resource hungry task and I haven't heard of any SE doing it routinely for a long time. I believe blatent "bad cloaking" (where a cloaked page ranks high for Disney.com but delivers the kiddies to a site designed for those over 21 years of age) still earns a ban pretty quickly at most SEs, due to user complaints.
IMHO, if you're going to the effort of cloaking (it is an effort!), use IP cloaking, and keep curious competitors out of your code. There is at least one, probably more, free scripts available.
For the past year or so, I've had better results using plain old on page optimization and I've discontinued cloaking. The SEs have evolved and become better at identifying sites relevant to a search.
More personal opinion, in a non-competitive category, cloaking just isn't needed unless your site is SE hostile. If it is, and you're in it for the long term, your efforts would be better invested in rebuilding the site.