That still leaves the wp-content directory and everything in it, including other plugins, writable by the web server. A malicious or compromised plugin can then check whether some of the highly popular plugins are installed, and modify their files to compromise the whole site. You don't need access to WordPress's core files to inflict a huge amount of damage.

Some directories do need to be writable for caching and uploading purposes, but those are just data, and data is usually inert. It's dangerous to leave any executable file (*.php) writable by the web server.