How does a new node know where to connect to initially? Is there a default (centralized) set of IPs that a node connects to when it's just starting up for the first time, in order to get the list of other nodes' Ips? What happens if these initial IPs are down, blocked or banned?
There are a number of DNS seeds hard coded into the Bitcoin client.

It's not really possible for these to be banned. The way DNS seeds work is by returning multiple A records for the DNS seed hostname, with each A record belonging to a node. In essence, they act as name servers, and use the existing DNS specification to provide nodes with the information.

It is possible for a network to tamper with these responses, or prevent the DNS lookup to begin with. In such a case, one could manually use the addnode option in Bitcoin.conf to connect to one or more peers directly. Once you are connected to a few peers, they will share their peer list with you, and you can connect to the other peers on the list, and get additional peers from them, and so on and so forth.