then you don't care if you're running on Solaris, 
    Debian, or CentOS.

That does sound like an advantage, but I generally run the same OS across all machines (for a client), so that's not a huge advantage for me.

    Fabric seems more like SSH with a for loop.

Definitely. And that suffices fairly well for managing 10-20 servers.

    if someone goes and changes a vhost file by hand, that file 
    will be replaced with a good one and Apache will be restarted, 
    even if that file was made by a complicated template.

Ah, so Puppet is running on a machine, it will maintain the configuration of the machine even if some well-intentioned user fiddles?