Apparently this is by design, as it's a WFS specification. See the relevant discussion:
http://osgeo-org.1560.x6.nabble.com/Why-the-WFS-does-not-return-the-NULL-value-field-td3802398.html
It is suggested in that thread to instead parse the "DescribeFeatureType" response, which does contain all fields.
Now if only there was an OpenLayers Control/Plugin that combined this behavior, I would be happy, but I think I'll be forced to develop it from scratch.