Per vhost throttling configuration is in "Virtual Host List" page, from where you add a new vhost.
The reason why we did not put them in the security tab for a vhost, is that the web interface was designed for two level of users, server administrator and vhost administrator, bandwidth allocation should be set by server administrator and cannot be changed by a vhost administrator. Currently we have no plan for the full implementation of two user levels.