What I don’t want to happen is some sort of major delay between the 0 day fixes being available for all WordPress users versus those who have paid for that type of comfort.

Comon Jeff, that'd be plain silly. It's in everyone's best interest (including Automattic's) that security fixes are pushed out publicly ASAP. Not to mention that WordPress(.org) is not an Automattic product. While many of us contribute to it and help guide it's development, it is it's own independent entity.

The advantage of having VaultPress take care of security uprades though is that upgrades would be able to be done automatically without your intervention which is currently required (you gotta be aware that a new version is out and then press that upgrade button).