I actually believe that using standard WebParts within .master pages is actually quite badly broken (conceptually), beyond the problem of their state being persisted on a per-page basis by default*, for one simple reason: the use of configurable WebParts requires the user to be authenticated.
To me, there is a big difference between customisation of layout to suit user taste (which is what WebParts are good at) and what users are allowed to see (the role of ASP.NET security).
Sure, in certain cases WebParts will require authorization. Only authorized users should be allowed to configure parts at shared scope, and so on. And it's undoubtedly true that certain WebParts might only be allowed to be displayed to certain users. But for an individual user, how they configure a WebPart's positioning or minimised or closed state is really nothing to do with authorisation. Try explaining to a user that they can choose a different theme without logging in (say by storing the theme in the anonymous profile), but not whether the calendar is in the top right or bottom left corner!
If you place WebParts in a .master, then that .master can only be used satisfactorily within content pages that mandate that the user is authenticated. Note that word mandate is used advisedly here. It's not enough that the user actually is authenticated and is presenting an authentication cookie, say, in the case of forms authentication. If the content page falls under the authorization rule of <allow users="*" /> (i.e. all the public pages including the home page), then the WebParts will display incorrectly (if the user has configured them on another content page where authentication was required).
The core concept of a .master being a location where you can place common content is therefore gone if you place a WebPart on it, as that .master can now only be used in fully authenticated parts of the site. Surely WebParts would therefore be more functional in .master files if they were tied to "anonymous personalisation", say using cookies, rather than only to authentication?
As it is, I can only imagine using "out of the box" WebParts within a .master file on applications where the entire application would fall under the authorization rule <deny users="?" /> or a more restrictive setting.
Still, fair play to the ASP.NET Team: at least I can always tweak providers and override parts of the system to make them work the way that I want them to.
* See Jason Diamond's blog entry at http://jason.diamond.name/weblog/2005/11/09/web-parts-and-master-pages for the beginnings of a work around for this issue.