Make block visible to specific IP (in D6)
The commentators questions and remarks pointed me in the right direction, so here's the solution to my own question:

With page caching enabled, the above PHP condition is evaluated only occasionally on cache rebuild. If someone with the correct IP visits the site at the right moment the block can get visible and cached. Visitors with the wrong IP may then also see it (from the cache). Therefore the above approach is wrong.

Correct solution: Use IP login to authenticate some real or special user, then make the block visible to this user with the PHP condition:

&lt;?php
  global $user;
  if($user-&gt;uid==123) {
    return true;
  } else {
    return false;
  }
?&gt;


Of course, one could also define a new group and use the group-based visibility settings.