In a multi-VDOM setup, one VDOM typically acts as the management VDOM (often called "root") which manages global settings and security services like FortiGuard updates.
This management VDOM handles access to global security services that benefit all traffic VDOMs.
Individual traffic VDOMs process their own traffic and enforce security policies but rely on the management VDOM for centralized access to global security services.
Each VDOM does not need an independent security license; the license is for the device as a whole.
Traffic between VDOMs does not need to pass through physical interfaces to be inspected; inter- VDOM links and policies handle traffic inspection.
Each VDOM does not require direct FortiGuard connections; this can be centralized in the management VDOM.