I've delved into the implementation. Here are some initial observations:
Although file uploads are initiated from Silverlight, the client-side Silverlight code does not break files into chunks before sending to the server. This means the entire file is sent across the wire at once. To support large uploads with this architecture, you'd need to implement something similar to the chunking concepts used in this CodePlex Silverlight File Upload control project. For better performance with large uploads, it may be necessary for the Silverlight component to point directly to the WCF service responsible for writing the streamed file to disk.
Files stored in the external repository are not natively tied to Sharepoint security. Rather, the security model is patterned after the repository. For the sake of simplicity, the sample code stores the repository security model in xml files. Theoretically, you may be able to replace the calls to xml files with calls to Sharepoint web services. This would (again, theoretically) give you both external file storage and Sharepoint context for authorization, versioning, etc.