I'm may be planning to switch over to Drupal Commons 3. When the original Drupal core gets security updates, will I be able to get those updates in the Drupal Commons or do I have to wait for Drupal Commons to release their own patch? I'm not sure if Drupal Commons modifies the original Drupal Core's code. Sorry if this question is already answered in an FAQ somewhere but I couldn't find the answer and I'm pretty new to Drupal.
The Commons team has committed to having a new release of commons within a short period after a core or contrib security release so you should just be able to upgrade by following the Commons upgrade procedure.
It's a bit risky to update core or contrib modules inside of a distribution. If you can do it on a test site first, confirm that it's working, and report your problems with the test site to the issue queue then you'll help getting the fully packaged Commons out.
I'm having the same dilemma. Advice I've received includes checking my requirements to see if I need everything that Commons 3 has, or rather, whether there is something in C3 that I couldn't build quickly with available modules. If the answer to both questions i No, then forget C3. Nevertheless, as a non-programmer/non-developer, I think Commons is great as an out of the box solution, but notwithstanding the option to test/experiment with modules/upgrades on your own, you are committing yourself to the Commons Team and their development cycle (and note the timescale for the Drupal 7 version).
Personally, I like Commons 3, and know that Acquia will continue its development, however.