What is the correct user / group for ~/plugins/wordfence?

I noticed in Tools -> Diagnostics today that:

Checking if web server can write to ~/plugins/wordfence

is failing. Looking at my server, the ~/plugins/wordfence directory and all subdirectories and files are user: root, group: root.

Is there a security reason for this? I installed Wordfence normally through the add plugin functionality and have had it running for over a year. Haven’t noticed any issues other than not being able to manually upgrade the plugin. However, the automated upgrades work. Should I change the ownership on this directory and all files / subdirectories to the webserver / PHP user? Or will this open up some security issue?

Any insight would be appreciated!