We chose to use all .rpt files.
Two reasons drove this decision. The first was a VB limitation (solved, I believe, by the latest VB Service Pack and MDAC 2.5). The other is a desire to be able to update/change a report without having to reinstall the application.
We have 5-600 users and a system locked down so only adminstrators can install software. A nightmare when only changing a report.
To help secure the report files, we loaded them on a network drive as read-only and the directory is network-secured as read-only for all but the development team.
good luck
mlmcc