it's to route data internally to the vShield App appliance.
it's like VMKernel to Appliance, back to VMkernel.
Hence, no uplinks to a physical network.
it's a standard vSwitch to prevent vMotion requirements (each appliance is specific to an ESXi host).