SQL queries in theme functions - is it a bad practise?
Any theming function only format variables passed inside them to specified format.
If you want to get some additional variables from database you should use hook_preprocess_HOOK https://api.drupal.org/api/drupal/modules!system!theme.api.php/function/hook_preprocess_HOOK/7.

So, in your case you should implement:


hook_theme() in module to register new theme-function;
hook_form_alter() in module to modify form theme (as showed in your example);
template_preprocess_HOOK() in module, to get aditional info from database;
[theme]_hook() in template.php of theme to format variables as you wish.


There is no any performance issues, it is "must do" practice.
If you have version control system, and you need to change some output, it's no required to change module files.