“mostly”.

The point of running stuff as different users is to limit the impact of someone taking control of the software via bugs/vulnerabilities. If everything runs as the same user, breaking in is easy.

If you’re just running apache, serving static files and things, www-data is enough.

If you have a whole bundle of applications also running in apache (in modphp, modperl etc) you end up with lots of your own, custom, internet-facing code running as www-data, which gives the bad guys more of a chances to gain access to that user, and puts them in control of more stuff if they do.

It’s the Principle of least privilege and combined with a bit of compartmentalisation.