I just read that comment again and it doesn’t make sense (the last bit so here it is again)

www.domain1.tld  
unix user = znd  
vhost user = apache20:apache20  
unix file permisson = znd:apache20 | -rw-r-----  
+====+  
www.domain2.tld  
unix user = znd  
vhost user = apache21:apache21  
unix file permisson = znd:apache21 | -rw-r-----

Right so as can be seen clearly now same unix user account to access the files and change whatever - but different vhost userid:group so each vhost simply cant read any other files :)