In fact requires granting the User write permissions:
chmod u+w web/sites/default
Looks like there's a bug being worked on in the core issue queue. That thread provides a link to a workaround in d.o. docs about Starting a Site Using Drupal Composer Project Templates.
I've updated that documentation page with this form of the solution (with credit to various ppl noted in the changelog of Starting a Site Using Drupal Composer...).
Others point out that you'll need to make this change after each time you "change a setting via the web interface, which removes write access again."
However, if you are using settings.local.php (you should!), it turns off the setting that would undo your permissions change and allows you to work more smoothly with composer on your local. (See
$settings['skip_permissions_hardening'] = TRUE; and the docblock in that file that precedes it).