So to put what I'm cofused about plainly (my fault on the confusion I'm sure :D ):

It sounds like the reason for having that outside of your primary infrastructure (or more accurately, inside a cheaper bandwidth host) are lower bandwidth costs with the trade-off of some slower requests getting sent to your origin server when the cached resource expires/is invalidated.

Exactly! You're architecting your infrastructure to take advantage of the most efficient cost option at each layer.

So mainly thinking of Varnish as the CDN -- paying a 3rd party CDN is pricey.