Exactly right - an understanding of how to set up permissions properly is key.
In this example (post moderation), the moderation occurs with the "No/Not set" option. What would be the "correct" way (without using "Never") to ensure a user is always moderated if one or more of the usergroups they're in have it set to "No/Not set"? Any "No/Not set"setting will be overridden by an "Allow" in any usergroups they happen to belong to. Only the "Never" will ensure that any "Allow" settings are overridden .
I believe this is one of the situations where the use of "Never" is indicated.