Hello
From memory, my understanding is that packer will ssh into the vmware host and run the commands there.
The security implications can be that the user/password will have to be somewhere and that may cause problems. so the best will be not include the credentials in the same json file, use either variables, or a separeate ver json file.
from what I remember, vmware wont have this ssh enabled by default, so depending on the company it may take some time get this approved.
now, lets say you have vmware infra for prod only, then you could have a vmware build box, and use vmware workstation/fusion externally, and just share the ova to the vmware admin and follow their process.
vmware does have all the bits to be fully automated, is just not everyone use it in this way.
Alvaro.