SP2 largely consists of patches, many of which have been issued separately for 2000, and the upgraded security center, which is little more than a system-integrated security app which could be 3rd party as much as 1st party in terms of its integration (generally speaking). In other words Security Center, with its current level of integration, could just as easily have been made by a 3rd party (see: Norton Control panels and firewall integration). So there's nothing proprietary and deeply integrated there IMO. The rest is upgrades to IE and I don't think there's much good reason that couldn't be applied to 2k if they wanted it to be. As for DEP, the fact that it could even *be* applied as a patch pretty much guarantees it's not *that* deeply entrenched and influential on the core of the OS.
If you can upgrade from Windows 98 to Windows 2000 (and you could), then I see no reason the same can't be done from 2k to Vista. I really don't think this has much to do with technical reasons.