> Indeed. But it's only accidentally a sexp, in the sense that it's not
> actually a sexp in the buffer -- it's a comment.

It's a commented-out sexp, but it's still a sexp, and it has to be a valid one.

> What is the failure behaviour of package.el for this at the moment?

Package.el will signal an error during installation if it's not a
valid sexp. The error itself will depend on what the problem is.
Here's what you get if you miss a closing paren for instance:
    package-read-from-string: End of file during parsing