The owner shown in the filemanager is the owner as such. Each file may have its own read/write/x for owner, group and other. To try to lock down permissions requires looking into each app and also the packaging. Also note that ideally all app code (WP, especially developer edition, are special here) is anyways in read-only mode.
To get a better and detailed overview over ACLs set, the webterminal is the way to go.