One of the niceties of an RDS deployment is that I don't care much about the security issues: The machine is not in our VPC, there's only public data on it, and I presume that AWS has isolated the instance to their satisfaction. From my point of view, it's an ideal way to make data public and way better than running it ourselves.
If you can't access pg_hba.conf how about just sticking pgbouncer or similar in the middle and have your users connect through that?
I like the pgbouncer idea in principle, but it means more work for me that I'm not willing to take on for this use.
Thanks everyone for the input. I'll stick with an advertised password.