WordPress: FS_METHOD 'direct' how much is insecure?

I have a VPS. I'd like to avoid having to install a FTP server.. How much is WP FS_METHOD set to direct insecure? What system configuration should I avoid? Right now PHP/nginx is run by www-data, which I set to 'root' as secondary group. File permissions are 0775 and owned by www-data.