Users not knowing their permissions is security-by-obscurity at best, and it may actually turn out to be a bigger security risk, bottom line. Users want to get things done, that's what they're paid for. If they can't, there are two possible scenarios:
a) Users run into obscure problems ("I saved a file there and there, and it just disappears"), they try to "solve" them on their own and become creative, possibly introducing all sorts of security and maintenance nightmares.
b) Users run into problems, but can find out that they lack permission to do what they want; typically, they will go see whoever is in charge of security and request that they be given suitable permissions, at which point it is possible to step in and either grant those permissions in a sane way, or show them the proper way to achieve their goals.
Also, if being able to view one's own effective permissions makes a system vulnerable, then the permissions are either flawed, or not properly enforced. After all, an attacker doesn't need to check permissions, (s)he can simply try to do what it is they want and see if it succeeds.
Viewing someone else's permissions is a different story though: it means that once you have broken into a non-privileged account, you can quickly find out which other accounts are most valuable for you (administrative permissions, access to interesting files, etc.) and then mount a targeted attack specifically for those users.