TLDR: That paragraph is incorrect.
So How Does WordPress Handle Permissions For Auto-Update?
WordPress runs as the user that PHP runs as, which on most servers is some form of www user. It uses that user to perform the update.
If that user cannot write to those files, it falls back to other WP_Filesystem providers. This is why some people see a request for FTP details when updating. If FTP details are entered and they are valid, WordPress will use FTP.
If it cannot make direct filesystem changes, and it cannot use FTP to do it, then auto-updates cannot happen.
Can WordPress Run File Operations as The Owner of the file?
For me that sounds very crazy. If the files are owned by root, does wordpress gain root access to the server?
No. It can’t.
PHP processes can’t escalate themselves to the root user, that’s not how things work. It’s not how processes and users work either.
PHP cannot change the user it is running as either. That requires server configuration changes to do.
Is The Paragraph on .org Correct?
When you tell WordPress to perform an automatic update, all file operations are performed as the user that owns the files, not as the web server’s user. All files are set to 0644 and all directories are set to 0755, and writable by only the user and readable by everyone else, including the web server.
That paragraph is wrong.
What I think has happened, is that somebody who is not a native english speaker has written that paragraph, or that they themselves have misunderstood how updates work. Whatever the reason, this paragraph is incorrect, wrong, false.
However, if you want to really harden WordPress, make the files executable and readable by the web user, but not writable, and disable the built in auto-updater.
Then tools such as git, composer, or WP CLI can be used to update WordPress and its plugins/themes either manually or on a cron job using a different user.
E.g. on my host I can SSH into the server and make changes as my SSH user has access to those files. This way any malware that runs cannot modify PHP files. This has the downside that WordPress is unable to update itself from the web interface. I then run WP CLI commands to update WP and .org plugins, and a combination of git pull and composer commands for the rest. I could even refactor things to use composer for the entire site.
You’ll see some high end hosts do something similar by managing WordPress themselves, and providing you with a git repo that’s equivalent to wp-content so that plugins and themes are version controlled. This has the benefit that any changes are immediately obvious and can be undone instantly.