When you first extend an IIS web  site, sharepoint  will use the
web.config found in the config  folder of the "60 hive". There are
several variations here but I haven't researched how the different
template options may effect which .config file  is chosen.

Try changing the trust level in this web.config and then extend a new
IIS Web site. You will see the change in the default  web.config used for
that new Virtual Server. Unfortunately, I believe that this is a
farm-level only option. It would be great if you could specify a
different web.config for a custom site  definition but I don't know how
to do this.