The idea of the NoFollow attribute on links was to help prevent spam from appearing on user generated content sites, particularly Wikipedia. It was intended as a way to tell Google (and eventually all major search engines) that a link was not supposed to transfer any “link juice” to the recipient of the link. In essence, it was designed to stop SEO spammers from trying to insert their links where they didn’t belong for the sake of improved rankings.
It has become an abused attribute. This needs to stop.
Modern use of nofollow by many websites is to prevent link juice “leakage” from a website onto other websites. Many put the attribute on any link that isn’t internal. Some go so far as to put it on every link, internal or external. This is ludicrous.
There may be some merits to the idea that leaking PageRank juice to others is a detriment to the optimization of a website, but if there is, it’s minimal. I’ve seen websites that have a completely closed nofollow policy that doesn’t “leak” any juice at all that have major troubles ranking and I’ve seen sites (such as all of my sites) that rank exceptionally well while giving link value to everyone.
There are exceptions. UGC, as mentioned before, should have nofollow attributes attached to links that are not vetted. If it’s a UGC site that passes through the eyes and scrutiny of an editor, the nofollow attribute isn’t necessary. If it goes live immediate, it’s necessary.
Comments or other areas where links can be added by anyone should also be nofollow. Some use plugins like CommentLuv to encourage comments by making links followed. This is up to site owner and as long as the comments and links are vetted I have no problem with it at all. If the links in comments aren’t vetted, I don’t suggest it.
Otherwise, there should never be nofollow links on websites. If a link is good enough to post, it’s good enough to get juice. Trying to sculpt or channel your link juice is futile, ineffective, and an argument can be made that it’s actually more damaging than good.