The problem is that each has_capability() call results in db access the first time when capability+context used. The performance of has_capability() was improved in 1.9dev, but it is stil a major problem in 1.7.x and 1.8.x.

It is recommended to do the permission checks only when needed, it is not a problem the do the same check twice, because the results are cached in static cache inside has_capability().