Notice: The author of this answer is affiliated with ionCube. Please keep in mind that answers and comments submitted by ionCube employees, whilst with good intent, may be subject to conflicts of interest.
The answers here are good, though thoughts such as "any nosy customer wouldn't have much problems extracting the encryption key from your compiled code" stretches things somewhat because end users and even most PHP developers typically lack the knowledge required in terms of modifying the PHP engine to expose runtime data in any useful way.
Bytecode protection is based around compiling code to a different language, the bytecode, and making best efforts both to make the bytecode and metadata hard and expensive to discover as well as understand if one gets it. ionCube compiles the code, uses various techniques to protect the bytecode, and uses a non-standard PHP execution engine in order to be able to use bytecode that differs to the bytecode that PHP would normally produce. This accounts for the relatively large size of the runtime Loader component when compared to the same from some other solutions.
Using PHP functions such as
get_defined_vars() that you mention may not be possible because files can be encoded so as to work only with encoded files produced by the same copy of the Encoder, and to fail if an encoded file were replaced with a non-encoded one. Similarly, using obfuscation of variables can disrupt the results of such functions.
There are limitations to what is possible with PHP being opensource though, as well as tradeoffs in balancing the goal of protection with runtime performance and compatibility with standard installations in particular, shared servers. While passwords to
mysqli_connect(), for example, may be well protected, a hacker could modify the mysql library or the PHP mysqli library wrapper and recompile PHP to expose the password at runtime. This may not be an issue in practice however, and if it were, there are ways to increase security provided that compatibility with default PHP installations is not required. Contacting ionCube for advice is recommended to get insight into strategies that best suit your use case, and you may learn of non-publicised possibilities that you would not be aware of.