I'm reading an Ubuntu security guide developed for the US Department of Defense, to be found here. Written for 16.04 but I don't think this particular item has changed much. The guide says,
Group ID (Vulid): V-75583
Group Title: SRG-OS-000480-GPOS-00227
Rule ID: SV-90263r2_rule
Severity: CAT II
Rule Version (STIG-ID): UBTU-16-010840
Rule Title: All world-writable directories must be group-owned by root, sys, bin, or an application group.
Vulnerability Discussion: If a world-writable directory has the sticky bit set and is not group-owned by a privileged Group Identifier (GID), unauthorized users may be able to modify files created by others.
I'm not getting the logic here. Sticky bit on a directory prevents deletion of files, not modification. My only guess is that they are talking not about modifying the file but about reading the file, deleting and then recreating it. This scheme works only if the file was world-readable in the first place, which it should have been not if it was any sensitive.
Overall, I'm lost. Does this rule make any sense at all?