I am a learner of FOSS licensing, security and privacy. I ask this question because one of the arguments persuading users to use or switch to FOSS is the fact that since the code is open, an expert can review the code for security issues and hence FOSS is good for security. However, I had this doubt whether code obfuscation is common in FOSS and whether that would be an impediment while reviewing FOSS source code. Has anyone encountered the issue that I mentioned? Does any of the popular FOSS licenses say anything about code obfuscation explicitly?
...because one of the arguments persuading users to use or switch to FOSS is the fact that since the code is open, an expert can review the code for a security issues and hence FOSS is good for security.
Be aware that being FOSS only allows for the potential scrutiny by experts. Simply being FOSS does not necessarily imply experts have scrutinized it. Obviously, high-profile, popular packages are likely to have been extensively "pulled apart" by experts, but a little-known package (or an obscure fork of a popular package) might never have been "studied", and therefore would come with no "reassurance" about its security.
While there is nothing to stop someone releasing "freely available" code only in obfuscated form, (a) it seems to go against the "point" of making it freely-available if it's hard to read, and (b) as noted by others, some of the more common FOSS licenses/initiatives prohibit releasing source in an obfuscated form1.
As such, if you encounter any software that is "freely available", but only in obfuscated form, I'd assume even less about its security than the most obscure (as in little-used) piece of easy-to-read code. Indeed, the very fact that it was obfuscated would be a considerable red flag.
1 Clause 2 of The Open Source Definition from the Open Source Initiative includes (my emphasis):
2. Source Code
[...] The source code must be the preferred form in which a programmer would modify the program. Deliberately obfuscated source code is not allowed. Intermediate forms such as the output of a preprocessor or translator are not allowed.
While the GPL does not explicitly mention obfuscation, section 1 of the GPL v3 includes:
1. Source Code.
The “source code” for a work means the preferred form of the work for making modifications to it.
and I think you would be hard-pressed to find anyone who prefers editing obfuscated code!
In general, security oriented open source software relies on Kerckhoff's Principle.
In short, assume that absolutely nothing is a secret except for the key itself. Any and all attackers should be able to decipher and reason through any attempt to obfuscate your code because, above all, a computer will also need to be able to execute it.
The only strength that a computer has over humans, is its ability to make calculations at a higher rate. They can't guess or infer anything; you have to tell it explicitly how to accomplish every step. You have to put in the steps to de-obfuscate your secrets into the algorithm itself, or the computer can not and will not be able to handle your data.
The very phrase "open source" means that every single instruction to de-obfuscate your secrets is available to everyone who is able to understand it.
So no, obfuscation is not common in software that is licensed under an open source license.
I had this doubt whether code obfuscation is common in FOSS
No. The purpose of open-source code is to make the source code available and modifiable by users. Obfuscating code prevents either of these goals from being achieved.
I have occasionally seen plugins to open-source software (like WordPress plugins) released in an obfuscated form to provide technical compliance with the terms of the GPL license (which requires addons to GPL software, like WordPress, to also be released under the GPL) while obstructing users from making modifications to the code. However, it's unclear that this is even compliant with the license, as the code isn't being distributed in its original form, and it's generally considered an unfriendly behavior anyway.