the reason asterisk user is required is because the ARI needs access to the users voicemail files and pre 1.4 the permissions were hardcoded for those with no group or world access. There is a way, when starting up Asterisk, to change those permissions although I don’t recall right now, you will have to check the app_voicemail.c code. (It needs to be set in the environment before starting Asterisk). So the Asterisk startup has to be modified to accommodate this. You will also need to modify freepbx_engine as it sets all ownership to asterisk:asterisk whenever you start. (This has been modified in 2.5 to prepare for non asterisk apache users. The startup for asterisk still needs to be addressed to handle the environment variable.
no its not in the makefile of asterisk, it now uses your umask setting and 2.5 allows you to set that prior to starting asterisk so it is set right, as well as letting you set what your apache user is as well as other users.
you umask may already be setting the permissions properly. You should check as it may be that they are being set to broadly with more access then you want.