Now, let's take your statement here:
How do they find the latency - is there any increased latency and were they able to live with it or did they set it back to background mode and therefore these threats/malware that may be identified is no longer blocked.
I would like to clarify something very important. Background option does not mean that ll malware will be passed through. Only if classification is taking more time than file transfer, i.e for totally unknown & first seen zero day, that will be the case. Once it is emulated and fingerprinted, it will be caught in transfer and blocked.
Also, I am not sure why you are trying to present the case in a binary mode: no security or no connectivity. Background mode has a decent catch rate although some unknown things can sneak in before emulation is complete. Hold mode means some bigger delays with file transfer for content that cannot be immediately classified. There is also tons of "in between" here, with Custom option, and depending on your specific needs, there is always a way.