What's a common SolMan security pain point, and who should own SolMan authorizations after configuration?

A common pain: no one outside the Basis team gets SolMan access.

7.1/7.2 provide out-of-box single + composite roles for on-demand authorization; after configuration, hand ownership to the SAP security team. Three SAP security guides: Authorization Concept (high-level design), Secure Configuration (technical/background/RFC users, ports, virus-scan profiles), Application Security (composite roles per function — the most important; consult it when assigning composite roles by tool).