jdcohan, you may b over-thinking the problem like I did. I thought I had to replace the 8 defaults to use the randomize function, but no. Once you upload a few of yours you get a new "Random" button for the ones you loaded. (the defaults never get loaded into view then)
It seems you can load more than 8 as well.
You never have to use the default ones then, and they don't need to be replaced. With regards to losing your custom headers on an update, no doubt you would, BUT.....
If the are simply uploaded as new banners into the header page without going into code, they are saved in the media library as headers. (my new ones are) That's just like any other normal "data files", (like comments) it should never be deleted in an update.
I would imagine the media library is as secure as the posts themselves.
BTW, I had marked this one resolved, I may be the only one to show up. If this doesn't help you likely need to start a new thread.