All Source games, not just Deadlock, did and still somewhat do have a strong modding scene. The way it's handled now is that official Valve-hosted servers have a config option called sv_pure set that prevents most mod .vpk files from loading on connecting clients (though some things like custom HuDs are whitelisted by this system). Once Deadlock gets paid cosmetics you can expect sv_pure to be turned on for Valve servers, which 99% of the playerbase will exclusively play on.
What's the other 1%? For eg., in Dota 2, if I create a private lobby, would that allow the mod vpk files? Or only for local bot matches? Or some other more involved scenario?
Not sure about Dota specifically but for e.g. TF2 any non-Valve-server game had pure off by default. That does mean bot matches or private lobbies. You could hop into a community server and run your mods fine right now if you wanted.