At my place of employment (a medium-sized private liberal arts university), we use three different firewalls. First, there's a perimeter firewall that polices all traffic between our internal network and the internet. Second, each VLAN has a firewall. Third, each host (whether Linux or Windows) has its own host-based firewall.
All firewalls are configured with a default deny on inbound traffic and we poke holes only where necessary. There are generally no rules on outbound traffic (except things like blocking SMTP, DNS, etc) Yes, this means that there's a bit of extra work that needs to happen to, say, open up ports 80/443 for a new webserver (network team needs to modify the perimeter firewall and the VLAN firewall, and the systems team needs to modify iptables rules), but the benefits are well worth it.
For instance, say we didn't use host-based firewalls and some box in our Linux server VLAN got compromised. In this situation, the compromised host would have access to all ports on the other servers in that VLAN, possibly allowing other hosts to be compromised as well. With host-based firewalls, though, you limit your damage. In our case, we only allow traffic to specific ports from only the subnets where they need to be accessed from. For instance, we generally only allow access to port 22 (ssh) on our servers from the subnet where our team's workstations live.
In conclusion, my feeling is that implementing host-based firewalls while at times is cumbersome, is well worth the extra effort.