Confusion about files permission
Your example permissions (as listed near the befinning of your question) are fine.  The Drupal docs page you link to is correct and reflects IMHO the consensus of the communty.  The script you're using reflects this consensus.

I'd say that this is a false postive from Security Review. It also appears that this bug has been reported to the module's issue queue.

As stated on the Drupal docs page: All you need to know to review this yourself is that it is only files/ and the directories and files below it that shall be writeable by the server.  So if the character wshow up in anything owned by www-data or the www-data group on your site (letter 3 in the permission string is the setting for the www-data user, and letter 6 is the the setting for the www-data group) - then the site is not secure.

While it may appear insecure that files/, its subdirectories and uploaded files are writeable by the server, this is not the case. Drupal itself and the way Drupal sets up the web server (by means of .htaccess, etc. ) prevents code (shell scripts, php, etc.) that an attacker may upload (disguising it as an JPEG or other "allowed" upload file types) from being excuted.  Drupal has built-in management of uploaded files that ensures, for instance, that file attachements is deleted when the node they're attached to is deleted.  For this to work, the upload directory (e.g. files/) and the files it contain must be writeable by the server.

Also: greg should not be a member of the www-data group.