The answer to this is rather complicated.
On a shared server (running more than one website), using an setuid process for PHP (via whatever means) provides extra intra-user security. If two people have access to a server, and their scripts run as them instead of as a single "apache" user, then somebody breaking into one site via the web only gains the privs of that user, not the privs of "apache", which will be greater (apache can see everybody's web files, for example, in order to run them, but "otto" can't see the files of "bob").
In this case, WordPress will be running as "otto" and not "apache". Since it's running as "otto" and the WP files are owned by "otto", then it can just write the files directly and doesn't need FTP credentials.
See, it's all about ownership. If the files are owned by the same user who WP is actually running as, then it will use the direct method. If not, then it has to fall back to the FTP method (or other), because the important thing during an upgrade is that file ownership does not change. If it tried to write them directly as the apache user, then "apache" would own the resulting files. Which might be a security risk on a dedicated server.
For a dedicated server, having the files owned by a non-apache user while having the PHP run under 'apache' is safest. Perhaps even setting up a special user just for owning those files might be preferable and securer in such a situation. Then the credentials to upgrade could be put into the wp-config file, and even if they were stolen in some manner, wouldn't pose a threat since those credentials could be locked down to where they had virtually no access to anything but the WP files themselves. Then if somebody did break in, they'd either break in as "apache" (which has limited privs) or be able to execute code as the custom WP user (which also has limited privs).
The idea is to limit the capabilities of a user who finds a hole in the system. When somebody finds a weak spot, then they will be further limited by the privileges of the user that the process they broke through with is running as.