Yes, because "/system" folder is writable for webserver and when webserver isn't too secure, then other users (who have websites there too) on that server can place whatever they want in your "/system/cache" folder to be shown instead of your website.
Of course, when "open_basedir" is configured, then PHP can't be used to hack that way, but if someone will get full shell access to webserver, then it will be hacked in any case.
So this option only protects In-Portal from being hacked on hostings with low security level (that's are easy to hack).