@Chip Bennett - The resources involved go substantially beyond those involved in update notifications, including liability and the need to have serious engineering talent oncall 24/7. Polling for updates involves truly tiny amounts of bandwidth per site and not much CPU - either there's a newer version or there isn't. When an update is available, the user initiates it, is responsible for it and is right there to deal with any problems than crop up. The cost is relatively small.

Once you get into hot-patching, you step into an entirely different territory. Dealing with millions of sites, a million variations of plugins, themes and ugly core hacks, it is impossible to predict how each site will be affected by the patch. The owner of a site that goes down might be asleep, at work or on Safari for three months. If his site goes down at a direct result of a botched patch, Automattic could be liable for all sorts of losses and, at the very least, their reputation would get a drubbing.

So, when an exploit pops up, Automattic will need to have experts on hand to figure out how to counter it, create the patch, test the patch in as many different simulated environments as possible, release it and stick around to deal with any disasters that result. By the way, a side effect of all this effort and talent being poured into VaultPress should be faster and better patches for regular WordPress users, so, yay!

Continuous monitoring is also much more expensive, because bots would have to keep reading your entire site, using a lot more bandwidth and CPU than simply posting an update notification.

So, yes, they do need to charge, I am just hoping that they will put this within reach or regular users too.