Apache should not need to own them, just to have write permission on them. In either case, though, if you are on a shared host, it is possible that another user could use a script launched by the web server to alter that directory's contents. That can be obviated by the open_basedir configuration setting, but that only affects PHP scripts.
