I know that it should be done on activation/deactivation, but once either of those evens are triggered, don't you still have to respect the traditional hook process in order to ensure the rewrite rules are flushed AFTER they've been modified?
who said that wordpress has a bad code and bad security? a maintainer of a library had just justified to me his use of eval :(
@MichaelEcklund rewrite rules should always be registered on init
IIRC it does not matter much when you flush them
@JackJohansson those plugin activation hooks are overly appreciated. There are all kind of situations (multisite network activation) in which they are not going to be triggered
@MarkKaplun It seems like it does, I did a quick dive in the core and it looks like the rules are flushed no matter if they aren't changed. Also, in every corner of codex you can find a note "Don't just flush rules on init"
@JackJohansson not sure what you refer to with "it does". in case it is plugin activation, well it is not triggered on upgrade or git pull etc, so there is no reason to actually trust them, and this goes to themes as well.
as for rewrite rules IIRC all that flushing does is to delete the option. Maybe if you do it in init there might be some race condition, but I wasn't thinking about such edge cases.