Where this scheme is most secure is in private instances with friends you trust. If you are never in an instance with a ripper, and they try to rip your avatar entirely off the VRChat API, they would have to brute force the 32-bit key. Doing so could take months depending. It would...
The mods they are probably after are the ones that allow end users to rip other players avatars. This has been such a huge problem that, you can almost guarantee that if your model is not a stock model VRChat came with, and ...