With nginx, should all files being served be owned by www-data? (assuming nginx is running under the context of www-data).
Or is root ok?
For 99.9% of situations the web pages should absolutely not be writable by the www daemon. This includes the www daemon owning the files or directories. I've found it to be very common for root to own the files/directories, 644/755.
If there's an exploit of any kind, it'll be more likely that your website can be modified, defaced, infected with malware, or any one of a hundred other scenarios when owned/writable by the daemon.
php-cgi
processes externally anyway.