My question would be where is the dll for the 3rd party image viewer
going? My suspicion is that since that's the dll that actually writes
to the cache that's the one that is causing the security exception.

I've placed both my webparts DLL, as well as all of the Atalasoft
DLLs (including the one containing the web  viewer controls) into the
GAC.

Actually, I have one other piece of information that may help. For
non-image files  (eg. pdfs) I just provide a link button that, when
clicked, calls an event handler that downloads a byte array. Rather
than call the database every time, I write these to the cache for
reuse. This process is similar, but doesn't involve the 3rd party
DLL. It also worked OK with SmartPart, but is now failing with my web
part. In this case, the exception is thrown on the FileStream write
method, with the exception:

"Access to the path 'C:\Inetpub\wwwroot\wss\VirtualDirectories\80
\ImageCache\learning.pdf' is denied."

Does that help locate the problem?

A co-worker suggested following the permissions  trail of the folder
using ProcMon.exe (downloaded from Microsoft). Once I did so, I found
the culprit: My app pool identity WAS configured correctly. However,
the following line was set to true in the web.config:

<identity impersonate="true" />

Our site is using forms authentication with
AspNetSqlMembershipProvider. Since impersonate was set to true,
therefore the anonymous identity was attempting the write (and, of
course, failing). Once I turned off identity impersonate, write was
successful.

Read still failed, because read went to anonymous access. I could
resolve this by setting "Read" only permission on the anonymous
identity for this folder.

Remaining questions:
1) What is the default Sharepoint web.config setting for <identity
impersonate> (this dev machine has been in use for awhile, I don't
recall setting this entity)? Does Sharepoint require identity
impersonate = true by default? (It seems to defeat the app pool, so
I'm not sure why it would.)

2) When using forms authetnication, is giving "Read" only permission
to the anonymous identity for an image cache directory  considered a
bad security practise? I would only consider doing this because Read
is NOT using the app pool identity.

Any suggestions?

On a windows authenticated site the impersonate should be set to true.
SharePoint might work with it set to false, but most webparts assume it
is set to true. When you want to do something in a webpart as the App
Pool account you should do it by running in elevated privileges. That
uses the App pool identity account. That is even more true with FBA
based sites since normally there is no windows account to impersonate.
Check out the following MSDN video.

msdn2.microsoft.com/en-us/library/bb466220.aspx

It looks like I'm HALF there with writing to an ImageCache
directory, using the default identity impersonate on anonymous user,
with Forms-Based Authentication, using elevated privileges (as you
recommended.)

One case works, the other, fails.

1) in the first case, I write my own code, including a
FileStream.Write() method. I have wrapped this code as follows, and
IT WORKS:

SPSecurity.CodeToRunElevated codeToRun = new
SPSecurity.CodeToRunElevated(MyMethod);
SPSecurity.RunWithElevatedPrivileges(codeToRun);

2) in the 2nd case, I am relying on a 3rd party control that performs
its own writes to the cache. I HAVE wrapped ALL of my interaction
with the control, including setting of properties, Open() method, and
the CreateChildControls and RenderContents logic:

this.Controls.Add(webImageViewer);
AND
webImageViewer.RenderControl(writer);

However, it is failing, and I am guessing this is because code that
the 3rd party control ITSELF runs (such as writing to the ImageCache)
doesn't fall under the CodeToRunElevated logic, above.

Is there a way to place the ENTIRE control and its logic within
elevated privileges?

The only way I can think of to do that would be to subclass their
control by inheriting from it. Not sure if that would work either, not
even sure they left the classes as inheritable.

Other than that I don't know of a way to do it