Profiles vs Permission Sets: Least Privilege Done Right in Salesforce

Most orgs we inherit have the same access problem. A handful of bloated custom profiles, each cloned from another a few years ago, each carrying permissions that someone needed once and nobody ever re