Interestingly enough, not long after a number of "blocked" customers (including myself) submitted complaints to ICANN about all this tomfoolery, GoDaddy contacted NameCheap and let them know that the blocking was all taken care of. Also, my stuck transfers suddenly unstuck.
We can all speculate about whether this was malice, incompetence, or just plain old DDOS protection working as designed. Either way, it looks like the squeaky wheel got the grease.
I would imagine that because just as they need to have the ability to transfer out, they also need to transfer in. It would make sense to whitelist in the event that there is an overwhelmingly large amount of transferring in.