why do we need oinstall as well as dba - and how do we use it properly

Hi,

We are planning to do a new Enterprise installation and I would like to get it right.

 
Some time ago, Oracle introduced multiple groups to install and manage a database (namely oinstall and dba), but I have never quite come to terms with why we need them both ?
If I create the oracle user belonging to both groups, but oinstall is the primary group, then when I install the software (binaries), all files belong to the oinstall group - which is fine. But, then when I create the database, all the database files are owned by the oiinstall group as well ? How does that segragate permissions ?