Yes, current releases do not have a way of prohibiting user-override of MCA params, so a user could indeed circumvent the directive to require an allocation. The original intent of the parameter was to close a hole that allowed users to mistakenly overload the head node of a cluster by forgetting to get an allocation prior to running the job. It was not intended to stop someone from deliberately violating that rule.
The devel trunk currently does contain the ability for a system admin to specify parameters that cannot be overridden by the user. This helps the situation, but a user could still build there own version of OMPI and bypass those specifications.
Bottom line: if a user is determined to violate the rule, there isn't much we (the OMPI community) can do about it :-(