Can I use the default VID and PID on the bootloader for my product?
the Arduino VID/PID? No, you shouldn't ("may not") use that...
If I use the stock SAM-BA bootloader, can I use its default VID/PID?
Atmel MIGHT have an excecption that allows their VID/PID to be used for bootloading only, but it would certainly be better if you had your own. The whole VID thing is a big barrier for small-scale manufacturers.