However, there's something working in the anti-spam camp's favor as far as hiding email addresses.

The mere fact that if you even spend a tiny bit of time hiding an address makes you no longer the low-hanging fruit. As long as a spammer can claim "we will deliver to 80 Million Addresses" which they got from simple scraping, there's no need to decode your entities.

On the mail receiving side, nearly everyone is doing some sort of anti-spam things now, so the spammers have to get more clever, and that indeed results in the arms race you describe.

Thus, just do something small. It's likely to be enough, for the conceivable future.