Major service providers have their public cloud service operated with vCO using shared session. vCloud Director also use a single admin session if I recall well and now powers vCLoud AIr
As Burke mentioned if you front end the workflow it is secure.
Mapping the same roles as in vCenter is possible, I guess just not in your environment with different SSO servers. Since vCenter was in the first place only vCenter Orchestrator there was no need to duplicate functionality.
Since vRO is the orchestrator engine on vRA and since vRA has all the policy based / reservation model vRO it does not make sense to duplicate this functionality either.
It does not mean it is locked and prevent you from implementing it in vRO since it is not too hard to implement a small DB listing roles and associating these with permissions. This was how Lifecycle Manager (basically a role based self service portal running on top of vCO) was built.
It all depends from where your end users start workflows. If it is from vCenter then certainly vCenter should handle roles for vRO.
vCO is really a component of the vCloud suite released as part of vCenter and as part of vRA. These are IMO the two components that should address the roles functionality.