At crawl time document ACLs are stored.  If you add users to MOSS individually a crawl is required for any updated ACLs to be reflected in the search results. I you add users to an existing AD group a new crawl is not required.

I see lots of questions about running Central Administration on 2 web front ends (wfe)s.  This is certainly a good idea to ensure availability by avoiding a single point of failure.

Here are a couple of good resources on the topic. 

http://forums.microsoft.com/Forums/ShowPost.aspx?PostID=2022953&SiteID=1