How does Homebrew no longer need ownership of /usr/local?

Today I ran brew update and after migrating the repository, it reported that it no longer needed ownership of /usr/local:

$ brew update
Updated Homebrew from 5371359 to 13f08a2.
...
==> Migrating HOMEBREW_REPOSITORY (please wait)...
==> Migrated HOMEBREW_REPOSITORY to /usr/local/Homebrew!
Homebrew no longer needs to have ownership of /usr/local. If you wish you can
return /usr/local to its default ownership with:
  sudo chown root:wheel /usr/local

This change seems a little dubious. How does brew accomplish this new behavior, apparently bypassing security controls?

According to this ruby script: update-report.rb, they've just moved stuff to /usr/local/Homebrew, which is still owned by you.

We now create all the root directories of /usr/local that you need and check ownership on them rather than requiring it on /usr/local itself.