Welcome to GPLDL - we are still beta - please report any bugs via the contact form.
Yeah you are right according to Envato they can do a split GPL licence so the PHP is under GPL but not the CSS or images. https://wordpress.org/news/2009/07/themes-are-gpl-too/
Thank you. WPMU Dev has a auto update function we could maybe use or strip down https://github.com/Automattic/wp-calypso so just update plugin functions. I don’t know php/js so not much use.
http://www.wpallimport.com/2015/03/didnt-upgrade-4-1-1-yet-might-get-hacked/ is a example of what happens :)