Apache and file-access permissions

[Limaunion]

Hello All!

As far I understand files under the DocumentRoot directive shouldn't be 
owned by the same user/group set to run apache, in this case www-data. 
So why does my default installation created files under /var/www owned 
by this user/group ? shouldn't they be owned by root with chmod 400 ? If 
there's a compromise for the httpd daemon it would have full control 
under my DocumenRoot...

Thanks in advance for your comments,
LimaUnion.