I think there's a useful distinction to be made between data and code here. Your code typically writes to your data store. Your code does not typically write to

I think there's a useful distinction to be made between data and code here. Your code typically writes to your data store. Your code does not typically write to your code. It's a lot more reasonable that an attacker manages to convince your code to write some malicious data, than it is that an attacker has full write access to your filesystem. As an analogy: your SQL database probably writes to a filesystem somewhere. If it's running on the same machine as your app server, it may be on the same filesystem. But, say, SQL injection attacks are still infinitely more common than "can write to the source file currently being executed". Or, to rephrase: being writable (by the user executing app code) is a default state for your data store. It isn't a default state for your app, or your kernel.