So I've actually come up with something (works pretty well and isn't really complicated)
It's not as easy (brain-in-neutral) for the user as the chromium-pepper method, but you get your flash plugin managed by xbps, and nobody gets sued.
By "not as easy", I mean that you can't have xbps-install run inside another xbps-install instance. The second instance won't be able to make changes to the plist, which means the files will be installed but unregistered, meaning unmanaged.
So you have to run a single command (THE HORROR!) to actually build and install the locally-created package.
The advantage being users don't have to learn use the void-packages tree (but they still should), and we stop seeing questions of "does Void have Flash? Why not?". Well at least from those who check the package list.