I built a shared hosting platform on Linux once. The "home" directories for each user were owned by the Apache user, and readable by the user the site ran as. IIRC, something like this:

  drwxr-x--- and "www-data:mike"

The htdocs directory inside was writeable only by the "mike" user in this case.

Of course, all cgi/php ran as the user account, rather than as the Apache user.

So even if the user screwed up the permissions and created globally read/write files, there was no way that any other user could access them.