Most firewall administrators adhere to the policy of "that which is not expressly permitted is denied," which would dictate the use of outbound ACLs. Besides being a good Internet citizen, any DoS attack outbound will consume your available Internet bandwidth, thereby bringing your business to a halt and having an impact on your operation.
Yes, you can use the outbound policy to try and restrict what services your users can use, but it only goes so far. A lot of stuff is now capable of running on port 80, and you can't shut that down. Furthermore, PIX does not have any application inspection (yet), so your mileage may vary on this point.
Personally, I have always recommended the use of outbound ACLs for the DoS reason and the fact that I want to know as much as possible what traffic is going through my firewalls. I also believe Cisco should make that the default behavior of the firewall (as well as disable ping to interfaces), which would be the same default behavior as just about every other major firewall vendor.
I once did a consulting gig for another company that had the default "permit all" policy in place outbound. We discovered they were actively participating in a DoS attack, but no one there knew it, nor could they tell from the volumes of logs generated. That's part of the problem with letting everything out. It can sometimes be very hard to tell the legitimate traffic from the bad stuff.
As for the PDM, it's a lot like tequila: An acquired taste. People either love it or hate it. I use it a lot to monitor traffic such as VPN tunnels, etc. (doing a show crypto ipsec sa in the command line is a pain), but for configuration, I still use the CLI. My major beef with the PDM is it continually inserts commands like 'pdm location' to help it sort out what is connected to what interface. I guess if I used the PDM full time, that wouldn't bother me as much. I do find it a bit slower on our WAN connections, though, so I stick with the CLI.
