It either modifies MPQ files (replaces the texture files before WoW starts) or modifies the process memory (redirects resource loads to different resources). Both are detectable, the question is whether Blizzard will bother.
They've done it before with Sons of Hodir repeatables.
It modifies the WoW process, injecting its tools into an open WoW instance.
According to all the people I've known who's used it, myself, and the various threads around the web, nobody has been banned for using this.
I guess it all depends on if they ever find a way to stop bots which inject themselves into WoW's memory process the same way. If they find a way to detect code injections, it's time to stop using Evermorph.