I wonder why is this a malpractice if there is a dedicated event kind?

"Other Stuff" does not exclude stringified json 🙂

And if the data is public no need to encrypt it.