It helps protect you because if the application in question is compromised in any way (or has a flaw, i.e. an accidental rm -rf /*), the only access it has is limited to the user it is run as. If it is run as root, it has full administrative privilege.

I run the setup you’re aiming for, and as the other guy said, DNS challenge is the way to go. That’s what I do, and it works beautifully. It even works with Caddy auto-https, you just need to build Caddy with the cloudflare-dns plugin.