IAB kick-off meeting for VPAID 3.0 standard took place today.
VPAID was designed to offer rich interaction with a video ad, but in practice is mostly used for verification & viewability.
Hence most discussions today were centered around bringing back VPAID to its original purpose, and standardizing verification as VAST events.
I am not convinced VPAID has much of a future.
Publishers will be particularly happy to see the back of VPAID, along with its security and performance issues. Trying to restrict access of the entire DOM to VPAID script is just a patch. As are attempts at controlling VPAID scripting language to limit, say, latency-inducing ad server calls.
Scripting capabilities within the VAST payload is simply a doomed idea.