fbsd safety of the ports

[dick]

I'm a bit confused. I always believed FreeBSD is a very safe system. 
That may be true for the core files, but what about ports.

On the net I read _never_ to let the webserver be the owner of its files 
and yet, ports like Drupal or WordPress make the files rwx for the owner 
(www) as well as the group (www). How does this fit into fbsd's safety 
policy?

I guess you might say it's the task of the port maintainer, but isn't 
there some kind of port acceptance policy?
Imho this situation is a bit confusing at least ;-)
I'd like to get some info on this if possible.