Directly accessing the filesystem for writing is evil… for most of the cases where people are actually doing that.
If you’re editing an image file, and it is in the wp-content/uploads directory, then you know, whatever. That’s not the common case. Plugins and themes don’t typically do that because they don’t have to do that. WordPress has the code to do that for them. That’s perfectly safe.
No, the thing plugins and themes want to edit are the dangerous things. They want to write PHP files with config information, or save custom CSS files, or things like that. They want to write all those things which are not safe to be world-editable.
If somebody on the same cheapo shared server as my site is decides to fiddle with my images and such, that’s an annoyance. If they decide to fiddle with my PHP code or my CSS, that’s a security breach. The question about directly writing to the filesystem being evil depends entirely on what you’re writing and in what context it is used.