Personally,  I like declarative security.
The more I can take out from the code and put in the configuration the
better I can server my customer. Some Pros are :

 No recompilation needed when security meta data change, since it was
never in the code.

 If the meta data is in XML form one could provide a nice UI to
adminster declarative security.

 Faster development time, as the developers can code without worrying
about security.