How does django-rest-framework decide what the default `allowed_methods` should be for a `ModelViewSet`?
The short answer:
In my case, I was accidentally sending my PATCH to the list URL, rather than the put/patch URL.

The longer answer:
I found that the problem isn't that one project has different defaults for allowed_methods, it's that the action_map and allowed_methods properties of the ViewSet change based on which of the ViewSet URLs you hit, since the action_map is influenced by the router (see SimpleRouter.routes).
So if you try to hit "//[base_url]/your-model/" with PATCH or PUT, as I was doing, it will say that only ['GET', 'POST', 'HEAD', 'OPTIONS'] are allowed, and patch() will NOT be linked to partial_update(), even though it uses the same ViewSet class and partial_update() is present in that class.
If you want to send a PATCH, you have to send it to "//[base_url]/your-model/[some_id]/".
The company I work for has 2 projects that use django and DRF 3.  

both projects have a ViewSet that extends ModelViewSet 
both ViewSets do not explicitly define the allowed_methods property and are just using whatever DRF figures should be the default
both ViewSets do not override or define any handler methods (create(), update(), partial_update(), patch(), etc.)

However, in one project the allowed_methods property defaults to [u'GET', u'PUT', u'PATCH', u'DELETE', u'HEAD', u'OPTIONS'].  For the other allowed_methods defaults to [u'GET', u'POST', u'HEAD', u'OPTIONS'].  Consequently, I get a 405 response with

Method "PATCH" not allowed.

when I attempt to send a PATCH request.  
What causes project 2 to be more restricted?