I can't believe that Microsoft have a section (with replication setup) that specifically allows you to provide customised stored procedures as part of the replication engine!!! If they didn't...
I see your point around the risk, but ....Should a service pack over write stored procedures that are created for a specific subscriber? I can't see why they would...!?