Yes it can be a security risk and can be considered as a security breach if your main account gets compromised or if you do something wrong by mistake - it differs from case to case depending on how important your project is and what you are dealing with. But if I were you, I would never use 777 permission or even something similar that anyone can easily make changes to my WebServer Directories. In other words, even if I own two Unix Users, one my X user and the other the root user, I won't give permission to X only because I'm looking for ease. On MacOS, like on Linux or any other Unix-Like OS, you can use ACLs - Access Control Lists -, you can set Attributes, or you can configure Apache in a way to have different root directories for different virtual hosts if you are going to deal with hundreds of users being in need of changing their own odds and sods inside the apache directories, but never underestimate DACs. Permissions that you mentioned are considered as DACs (Discretionary Access Control), 3 bits for the owner, 3 for groups, and 3 for others - also called staff. Anyway, I recommend you read about ACLs, I guess they will do what you need, default ACLs are used for granting/setting access control list on a specific directory to allow specific users and groups to have access right. For a quick insight on ACLs, you can use
+a option to set or
-a option to remove ACL. You can also you
ls -le to display set ACLs. For instance:
chmod -R +a "group:_www allow list,add_file,search,add_subdirectory,delete_child,readattr,writeattr,readextattr,writeextattr,readsecurity,file_inherit,directory_inherit" yourDirectoryORFile
ACLs are a better option - than changing permissions - that you can benefit form.
By the way, you should notice that that it is right that MacOS is safe and secure, but services including Apache, SSH, SAMBA, etc. are not secured since they are using and configured by the default state.
File and Directory permissions are one of the very basics and first permissions you will face with in Unix-Like Operating Systems. To secure your system, you really need to pay a close attention to every detail of the system depending on your purpose. Giving a full permission seems like you are deliberately providing security breaches in your system.
When it comes to Apache Server - or NGINX - you should first make sure about your directory safety. For instance in Linux, it's recommended not to disable SELinux (used for managin Mandatory Access Control, Role-Based Access Control - RBAC - and etc.), so in that case, after setting right permissions for directory and files, you can set roles and types in a deeper level of security. If it wasn't needed, everyone would use 777 - Read-Write-Execute for all Users, Groups, and Staff, so be sure there is reason why it isn't 777 by default.
And the next thing you should beware of, is your Firewall configuration and rules. MacOS is using PF since it's built on top of a FreeBSD microkernel (PF stands for Packet Filter - and IPFW stands for IPFireWall). You can use
man pfctl to read its manual page and understand how you can deal with it.