Returning to this as I am shortly going to ‘open up’ a couple of forums so that they have at least one public category.
Alternatively, I wonder if we could have a warning pop up (maybe with a confirmation modal) when someone attempts to onebox a secure category rather than an all out ban.
Another alternative would be to have a code of some sort before or around the link to force Oneboxing despite permissions.
Workarounds
This can be worked around by moving the topic being referenced in the onebox to the same category, rebaking the post, and then moving it back again. Bit of a pfaff though.
The other (and probably better) way to work around this is to quote the post of interest of course.