Actually, pg_write_server_files has enough privileges to execute those functions anywhere on the FS as far as C code is concerned, provided that the user running postgres daemon is allowed to (see convert_and_check_filename), but won't be allowed to do so by default as it won't have EXECUTE privilege on the functions.
