Yes. These accounts let you limit the amount of damage that an app vulnerability that allows shell access can do.
Let's consider the things you might want to proactively protect:
- Log files. These need to be written by a single app account, but not read.
- Configuration files and scripts. Some may be shared but they should not be writable by any app account, and unless you have good reason, make per-app config files only readable by that app user.
If your users are tied to database privileges, then any per-app tables should only be modifiable by that app's user, and schema change authority should be reserved to administrators.