by no means is it a big improvement, but it's forced me, on more than one occasion, to end up needing to enable an FTP server just to accommodate this behaviour

by no means is it a big improvement, but it's forced me, on more than one occasion, to end up needing to enable an FTP server just to accommodate this behaviour. Just... more work (and increased insecurity, even if only for a small window of time). my default for wp installs is to just take write permission off everything all the time, then re-enable it when I know I will be doing something needing to write (updates, etc). There are likely some actual WP users who are not technical yet actually use the system to do their own content updates, but almost everyone I know who's using wordpress is managing it on behalf of their clients, doing all the content updates for them. These people could/should probably get familiar enough with ssh and stronger security practices, but the 'one click update' for themes/plugins/core seems to give a very strong (but ...problematic) sense of security.