You forgot escape & encoded and eval()'ed inline javascript in DOM that inserts a <script> tag that bootstraps another URL-rewrited dynamically generated .js. And the best part is, the .js can not be re-requested as it's it's taken cautions to prevent re-play attack.

If it gets to the browser via HTTP then it's pretty trivial to intercept.

I agree, but yes it is: 1) you can't unscramble variable names, and 2) you have to prettyprint all js, even well-written js, or create a 'compression detection' algorithm.