Security model and menu access
Is the Drupal philosophy to create some content/view and assign permissions to that for these top-level menus?


Obviously there is no hard and fast rule about this, but generally speaking your hunch is correct. Drupal menus expect every link (even a parent) to link to some content. As an example, the "add content" link goes to a page that lists the available content types even though the content types are usually listed under "add content" in the menu anyway. 



I do not believe there is an example in core where a menu link is there only as a parent and does not link anywhere.