It appears to be hardcoded and is also likely independent of the attack bonus/penalty cap. This also applies to the attack penalties you get from Flurry and Power Attack. The defense penalties for those are hardcoded to happen as well, but they are actually implemented as a tangible (albeit in-engine) effect you can detect on the character, meaning that they are likely subject to the feats and effects cap.