You're not missing  anything. Microsoft designed security in SharePoint
to be administered locally in a decentralized model. The design doesn't
have anything built into it for centralized management of security.

Unfortunately, the tools given to the local decentralized administrator are
not adequate. Even someone with "Full Control" of a site can't see an
overview of the permissions  of an individual on that site, nor a list of
groups of which the user  is a member. Permissions management on a site with
230 users  and item-level permissions on 80 folders is a lot of work <rueful
grin>.

DeliverPoint is an interesting solution at the farm level (if you have the
$$$). It shouldn't take that level of infrastructure to handle permissions
on a single site.