Yes, mass assignment with Model.new(params) and model.attributes=params is a best practice for professional production Rails websites. Business and security rules for field updates are coded in the model (attr_accessible/attr_protected/validates).
That's how it's been since Rails 1. Which is cool. But it's error-prone for newbies, especially when Rails's model and controller generators make all attrs writeable by default, with nary a generated comment about how or why to lock things down. In a culture of convention over configuration, attrs should be locked down by default: "config.active_record.whitelist_attributes=true" for new apps, and throw a helpful message when I mass assign to a model that has no accessible attrs configured yet.
Interestingly, dealers already sell some of their new cars below cost. But they make their money back with service and financing charges, so the basic laws of economics still apply.
http://www.tadcast.com/ https://mashable.com/2009/01/12/tadcast/
(Also http://www.brandfame.com/ and http://videosponsorhouse.com/)
There are some other startups that focus on placing background music in online videos.