You are correct in that applying future updates would result in this issue.

I never hack Drupal core, but due to my various client's needs I have had to hack Ubercart's package modules several times in the past few months.

I just keep a txt file in the modules directory noting the files, lines, and changes I have made. I really only have a handful of these, so upgrading Ubercart would require an extra 15-20 minutes to make sure my changes are still in-place.