This has been brought up many times on the forums, most recently here.
I think the general consensus is that you should choose the approach that you have the most confidence in. It is possible to lock down your calls using either approach, and it is possible to have breaches due to sloppy code using either approach.
One pro of using the validated-method approach is that you can easily write mixins that extend auth functionality across your methods quickly. However, I’d think it could be just as easy to write a module and apply that to your allow/deny rules.