Am I correct in understanding that generally IaaS (looking primarily at rackspace cloud servers) will provide a virtual server where OS updates, software updates, anti-virus, managed backups and other common non-hardware server admin tasks will be required by the client. With PaaS (looking at heroku) on the other hand almost all of that is handled by the host with only maybe occasional external backups necessary. Flexibility and customization as the main trade offs?
Yes, you've got that right.
In case of Rackspace Cloud Servers (IaaS) you can optionally pay for Managed support, which means you can get Rackspace to take care of many of those sysadmin tasks. You'll still need to deal with some things though.
In case of PaaS you pretty much don't care about servers at all. As far as you're concerned there's just a web interface that allows you to publish applications. You can add optional services, some free, some paid, that add features such as a database, but you won't know how they're set up exactly.
You also have something like EngineYard, which feels like a hybrid of these two approaches: you can an customized EC2 instance that's ready for you to push your app to, but you can have greater customization if you also push Chef recipes to that instance.
I'm not sure if you get the best of both worlds of customization + standardized deploy environments, or the worst of both worlds with difficult to implement tweaks because the standardized environment doesn't quite work for you (and the customization is tantalizingly close).
As a side note, one thing about, say, Heroku, is that you will write relatively portable apps that scale horizontally. That's the straightjacket that PaaS offers you, and it's not a bad thing if you find that Heroku doesn't quite fit and you need a IaaS solution.