You can call it cloaking if you want, but I'd say it's zero risk.
There's no difference in content served to any user or search engine. All requests are redirected.
Some users see a HTTP 301 redirect while others see a meta refresh. In all cases the redirect is to the exact same URL.
Where's the problem?