Is it safe and correct to run Drush under the same user account that the webserver runs on?
In general, the answer is "yes", it is safe and correct.  However, the specific answer here depends on (a) your security policy, and (b) what you want to do with Drush.  Some people prefer to make the code files not writable by the web server.  If you had a setup like that, then you would not be able to run drush dl as the webserver user.

The other thing of note here is that any time you run any Drush command, all Drush commandfiles are given the opportunity to alter the command's behavior.  This means that it is generally NOT considered safe to run drush via sudo to root, unless you trust all of the code in your Drupal site to run as the root user.  This is not generally a concern for sudo -u www-data, though, as you are already trusting the code in your Drupal site to run as the web user.