Google’s John Mueller said in a Reddit thread that if you end up showing your hreflang markup just to search engine crawlers and not humans, i.e. cloaking, that it would still be considered cloaking but you probably won’t be penalized for doing so. He still highly discourages you taking this approach.

John was asked “My client is only serving hreflang mark-up to search engine user agents, not human visitors. Would this be considered cloaking?”

John answered “Sure, it’s cloaking.” “I think what you’re asking is more like “will I get a webspam penalty if I do this?” to which the answer is no,” he added.

John then said he would avoid doing this because it can be confusing down the road. He wrote:

I am not sure how many of you who implement hreflang actually cloak it. I mean, why would you? It is just markup anyway and humans aren’t looking at your markup.

Forum discussion at Reddit.