The short answer is this: Don't trust your vendor.
The long answer goes something like this:
Every Linux distributor has to make certain decisions when making their distribution. They have to decide what software to include, and what kernel options to enable. They don't know anything about your hardware. They don't have much idea what you intend to do with your Linux box. They do have to worry about supporting the widest range of hardware possible.
Out of this need grew kernel modules--the ability to insert code into the kernel on the fly. This is really great for assembling a generic system. This has less utility for Joe Average. Joe Average, you see, does not change his PC hardware that often. He builds a system, and installs an OS. Ideally, he should have some idea of what is in his system.
A kernel based around modules is kind of like a generic engine that can be placed in any car. A custom-built kernel would (for the purposes of this analogy) be a tuned engine that only fits in your car. Which do you think will be faster?
After speed, security is a concern. Redhat is infamous for leaving nice fat security holes all over their distribution. Their kernel is no different. A while back (redhat 6.1? 6.2?), they left a debugging feature enabled in all kernels. This was a feature that would be used by far less than 1% of linux users, but it _did_ open up a hole to the outside. TThis is what most people would call 'bad'.
Upgrading one's kernel should also be done fairly regularly. When new kernels come out, look at the features and fixes they offer. Try to decide if you should have them. When kernel 2.2.16 came out, fixing a nice big security hole which had existed in all previous versions, it was a week before the major vendors had new kernels available for upgrade. I had all my machines upgraded within a matter of hours after hearing the announcement--because I build my own kernels.
Building your own kernel is like having a tailor-made suit for the same price as a regular one. Who would pick off-the-rack over tailor-made?