A bit of clarification - only the root user can listen on ports less than 1024. This is for security reasons, otherwise system users could eavesdrop on each other.

Since web traffic is typically hosted on ports 80 and 443, a web server actually needs to run as root in order to listen on and server traffic over those ports.

To reduce the attack surface, increase stability (and probably other reasons) NGINX runs one parent process as root. The parent process manages spawning child processes as well as passing requests off to them. This means that the actual process that handles each request is non-root and less privileged.

The process owned by root is the nginx parent process. This process forks worker processes which are run by the user defined in nginx.conf.

The nginx process is running as www-data, so, the root:www-data ownership would only work with group write permissions set. There is no major issue with running with your web files owned by www-data:www-data but if you are concerned you could give ownership of wp-content to www-data and leave the rest of the install as root:www-data.