As long as function and variable names are arbitrary, you can write code that appears to do one thing and does something else. Far more damage can be done that way than by straight obfuscation.