But as long as the attacker can detect when the user opens devtools all your efforts are futile.
This sounds even scarier - the user should be in control and able to inspect the page without the page knowing, since as he mentions, the attacker could otherwise deploy countermeasures to evade.
Looking at the code it looks pretty easy to circumvent: don't use firebug, have the devtools open when loading the page or have them open undocked by default. The detection method for non-firebug devtools is pretty silly: it checks the window size.
Even so, I'd appreciate it if the browser vendors took additional steps to disable the detection of devtools, personally. I don't think they should be detectable under any circumstances, if that's possible to implement.
This sounds even scarier - the user should be in control and able to inspect the page without the page knowing, since as he mentions, the attacker could otherwise deploy countermeasures to evade.