This is definitely a take that's different than mine. That's great, I am looking for opinions.
Personally, I think of model.save and being "close to the DB" - this is where things that _must_ happen for data integrity go. If it's got to happen the same way regardless of how/when a model is saved, it goes here.
Viewsets define an API - and if an endpoint has a specific requirement do something different with the data, it makes sense to put things here.
Serializers are a definition of what is accepted, how it is validated and how the data is represented... I think of them as being closer to the client and a standard way for any endpoint dealing with a specific model to define that interaction.
That said - the difference between when to use the serializer vs the viewset methods for specific things seems sort of fuzzy to me. I feel like maybe we should be leveraging the serializer moreso than the viewset, so that viewsets only pull the pieces of an api endpoint together (serializer, permissions, actions, etc) and the serializer deals with the business... but I'm not sure. For example I needed to use the viewset.create method on one to deal with data post validation.. but maybe I could have also done that in the serializer...