As @jmangelo pointed out in the comments, the field was only returned if it was set. Someone with access to the Dashboard intentionally blocked a few users so that I could test, and the field blocked: true was returned for those users when performing a GET request to /api/v2/users.