I believe it's creating a new contract on the fly.
The 'vault factory' contract is ephemeral in a way... a new contract is deployed whenever the method is called, and then it's deleted in the same transaction group.
The contract account remains even after the application is deleted.
I think that's why you have to supply the compiled TEAL approval program and clear state programs.
There's no existing application on the chain that gets called... it's creating a new one from scratch each time.
I think the reference to VaultFactory.new probably just provides the the information for the ABI call (the method signature to use for encoding and decoding).
As I understand it, the minimum balance requirement only needs to be satisfied by the end of the transaction group.
The act of creating a vault and rekeying it is all done with inner transactions.
Hope that makes sense...