Comment 2 for bug 1044286

It is Debian Policy that www-data is the Apache user and packages may rely on that. You're of course free to change it, but it's up to you to change other paths owned by www-data aswell (a simple find command will do that for you).
'Detecting' what the Apache user is in every package that ships a web app seems error-prone. Setting the dir world-writable is obviously not desirable.