Unfortunately this doesn't solve the problem that WordPress needs to be able to write to itself. It's game over once every skid in the world can pop a web shell

Unfortunately this doesn't solve the problem that WordPress needs to be able to write to itself. It's game over once every skid in the world can pop a web shell in /var/www.