Groups, Groups and more Groups

I’d like to know what other large businesses do in regards to Security Groups. Specifically, do they create a Security Group to manage Distribution Groups? Security Groups for Read Only access to folders and another Security Group for Modify access to the same folder… and do that for nearly every folder in their environment? Then more Security Groups for Public Folder permissions, software application installs, etc. How many groups is too many so that the users tokens are too large and cause issue or Active Directory replication is prolonged?