Default apache running from one UID/GID isn’t too secure. Users can look into all virtuals hosted on server. No one can stop them if PHP/CGI is allowed.
One of solutions of this problem is to run PHP as CGI. With suexec this will allow to run PHP under certain UID/GID. Unfortunately running PHP as CGI slows things down. FastCGI comes with help here.