> You don't have to do this, you can set up sane permissions and use the wp cli[0] tool to install updates manually. I prefer to version sites with git and install updates locally, then git pull down on to the live server.

Yup this is exactly how I do that.

I also have a cron that checks "git status" and emails me if anything changes.