Yes, worker share update is limited to 1 share every ~15 seconds. The synchronization with the upstream pool (vanitypool) happens once every 10 minutes, allowing for new work and synchronization of solved shares upstream.
For block withholding, this doesn't work for the same reason miners can't spend from the addresses they mine for customers themselves. The split key concept is just applied at another level, with the pool also having a generated keypair for each prefix and adding
that keypair's public key to the upstream pool's exposed public key and handing it to miners. If you look at the
getwork for vanitypool compared to the
getwork for bitcoin-apps, you'll notice the public keys differ. That's protecting both the pool and, its miners.
When a solution comes in, the oclvanityminer private key is added to the pool's generated private key for that prefix and a final sanity check is performed to make sure the prefix matches. If it does, the solution is submitted upstream to vanitypool, and the result checked to verify the solution is indeed accepted.
With respect to automation, the only manual step for solutions is marking the reward as confirmed rather than pending, as a sanity check.
