Build-in Updater: Permissions why?

Hi all,

I want to update Nextcloud by build-in Updater. I have restricted the permissions by open_basedir. Why needs the updater access to the directory above the domainroot?
I hope to get a better solution so I do not have to change open_basedir before and after every update.