[T-Mobile Samsung Galaxy S 5] invisiblewave:
VS3 is the stock ROM for the G900T3. VS1 is stock for the G900T. Anyway, after more experimentation, I think I've answered my own question, the problem appears to be Xposed. It's not as simple as Xposed just breaking Wifi calling because I've had them both running successfully on this phone and also on the G900T we also own. I'm still tinkering though. Until now I've been using an old Wanam-modified Xposed module for TW, I'm just about to install his latest version and see if that helps.

I've also refined my method for installing the security updates, in case anyone else is still struggling with them. They don't touch /data at all, so you can safely flash them without wiping and without having to do any restores (assuming you're running rooted stock, as I do). Here's what works, it's very safe but a belt-and-braces approach is best, so do a TWRP backup first:

Download the update from Sammobile or some other reputable source.

Boot into Download mode (Bootloader) (hardware combo is Vol-, Home & Power together, keep hold of them until rebooting starts).

Open Odin, uncheck Reboot, click on AP button and select the downloaded image, then click Start.

Once finished and you get the Pass notification, reboot phone manually back to Download mode (Vol-, Home, Power, keep hold of them until rebooting starts).

Close & open Odin, uncheck Reboot, click on AP button and select your TWRP tar file, then click Start.

Once finished and you get the Reset notification, reboot the phone manually to RECOVERY MODE (Vol+, Home, Power, keep hold of them until rebooting starts). Don't sweat it if you don't get the reboot right, it'll just boot to system and the recovery flash won't have taken, just boot back to Download mode, re-flash TWRP, and boot back to RECOVERY mode.

Phone should boot to TWRP, then just install the SuperSU zip, followed by Xposed (optional).

Reboot System, phone will reboot, rebuild the Art/Dalvik cache, and you'll be back as you were but on the new security-patched version.

Update: It looks as if the latest Wanam-modified version of Xposed solves the problem. I've installed it along with FireFDS which gives me pretty much all the customizations I want and after several reboots WiFi calling is still active. To fix, I followed the steps outlined above with a slight modification, I flashed the latest stock image, VS3GPK3, then rebooted to stock recovery which does its "installing system update" thing, checked WiFi calling was working on stock (it was), then rebooted back to Download mode, flashed TWRP, installed SU, rebooted to ensure WiFi calling still worked (it did), booted to recovery and installed the new Xposed module (87.1), rebooted, then installed FireFDS & rebooted again. I don't know for certain if doing the stock recovery update thing made any difference, my guess is it might have, and it doesn't hurt to do it.

Update 2: I noticed earlier that the WiFi calling also wasn't working on the G900T. The icon was there earlier, but not when I checked this evening. I took the opportunity to experiment with the boot to stock recovery theory, and that appears to be the key to getting WiFi calling to work with Xposed. I tried first the quick way, flashed VS1GPK3, booted back to Download and flashed TWRP, booted to TWRP & flashed both SU & Xposed. Booted to system and the WiFi Calling option was missing altogether. I started again, flashed VS1GPK3, booted to stock recovery, let the phone boot and WiFi Calling was back and working. I then booted back to Download, flashed TWRP, booted to TWRP, installed SU, rebooted the phone, WiFi calling still working, so I then flashed Xposed and rebooted, and bob's your uncle, it works!