Thought 1: "Well, it used to work." Obviously, that's a pretty dumb justification, but that's what lead me to raise this in the first place.
Thought 2: The instructions on the Ubuntu community wiki (https://help.ubuntu.com/community/JeOSVMBuilder#Finishing%20install%20on%20first%20boot%20and%20login) imply, but don't actually state outright, that the script will be run as whichever user happens to log in first. Up-file from there the tutorial also covers configuring vmbuilder to create a user, and the firstlogin script goes out of its way to use sudo for all administrative actions.
I'm aware that you can add an SSH key for root logins via the ubuntu plugin's ssh-key option. However, someone following the directions on the community wiki (like me, before I did my research :) is in for a rude surprise when the firstlogin script never fires.
The example firstlogin script also does some package installation, which is unlikely to fit well in a per-user firstlogin script. This is fairly close to what I'm doing, and having an enforced configuration stage for stuff that's either difficult or impossible to configure via templates or packages during VM creation (for example, configuring VMs to act as LDAP auth clients, which is what I'm doing) that happens once, the first time you interact with the VM, is pretty useful.