While not MOSS, we have a LOB app that uses hosted WSS 3.0 for some collaboration scenarios. We semi-regularly tear down and build new sites as needs demand. As part of the deployment for new sites, we need to configure custom permission sets, create new groups, and assign the permissions to the groups.
We created workflows to remove most (not Admin) OOB permission sets, create our permission sets, delete most groups, create our groups, and then match up the groups with the new permissions, all using web service calls to the hosted WSS. Was a bit tricky initially, as creating a new permission set requires you to pass a bit mask for the access settings needed.
I love the workflows. So much better than doing it manually. Ugh.
I have on my radar to apply custom permissions to lists in our default template that gets deployed, but haven't gotten to it yet.