Definitely, there needs to be an AUH CODE. Burt it is true that some registrars attempt to make a transfer impossible. A good example is the following message I received last November from Enom, after submitting a request for an AUTH CODE (automated request, nothing special):
We recently received your request for the Authorization Code (EPP Key) to transfer your domain to another Registrar. I can definitely provide you with the code but I would like the opportunity to speak with you and offer solutions and alternatives to moving to another Registrar.
Sounds a little bit like people holding my domain hostage, isn't it? It was signed by Melissa Huddleston, Business Development.
I didn't reply, because my reply would have been quite strongly worded: is it their business to ask me why I asked for an AUH CODE? Anyway, for me, one thing is sure: I will never register any name with Enom in the future!
So the experience reported above is not unique, alas!