The reality is 'do not use it'. The only viable option at all for new customers is to use Role-Based Permission (RBP) Security model. Many new functions require it and you would be doing the customer a disservice to recommend anything but RBP. We do not even give our customers a choice or even tell them about the old model.
Hope this helps :-)