It provides reasonable filesystem isolation for non-root processes. However, chroot has several limitations. Mainly, the root user can easily escape from the environment. It would be better to use an isolated environment that provides root privilege isolation, such FreeBSD jails, Linux containers, or Docker.
If a hacker finds a way to exploit the web application in a way that allows him/her to run some code as root, chroot only provides the protection that the hacker may not know he/she is in a chrooted environment. If discovered, the hacker could run some trivial code to chroot into the system that you are trying to protect. This is not so much the case with the other technologies mentioned above, where a root escape would be considered a vulnerability in that technology rather than expected behavior.
The answer to your question comes down to what is enough for you given the specific services and web applications being exposed.