Tented QFN/QFP Via in pad
Here's a pretty decent example of mask-tented vias in the thermal pad of a QFP. Most manufacturers recommend no more then 100 - 125 um wider than the via to minimize voiding and thermal insulation in cases like this. This is a reasonably inexpensive way to handle vias in the thermal pad. Sometimes though, the tents will pop open allowing solder to wick down through the via.
The mask over the center via on the right looks a little thin, so you'd want to give it an extra look over after reflow to make sure it's okay. (We'd do that here, of course)
We'd rather not see this technique on really small parts because it gets difficult for the fab house to put the mask down with enough precision. With small parts, filling and plating over the vias is the preferred technique. Well, that's always the preferred method. It's just more important with smaller parts and BGAs. This method is acceptable for most QFPs and larger QFNs though.
All your via are belong to us