Why does Drupal harden permissions of the /web/sites/default directory and files?

Question

I understand that Drupal hardens permissions of the /web/sites/default directory and its files, each time that the system_requirements() function is called, typically after each composer require operation.
The particular hardening is removing the write permission from the user of the Drupal file tree, and to soften that hardening one would have to do chmod u+w web/sites/default.

If I understand correctly, why does Drupal remove the write permission from the user of the Drupal file tree?
What typical problem does it prevent, or solve?

Answer 1

The settings.php file contains the database password and username in plain text and, once created, must be set so that only appropriate users can read it. That usually means removing read permissions for the "other" user.

— https://www.drupal.org/docs/administering-a-drupal-site/security-in-drupal/securing-file-permissions-and-ownership

It is not particularly clear in this question if you are asking about files or about the sites/default directory. In the case of hardening permissions on the sites/default directory itself, that is to prevent the addition of files.

The original reasoning is in this seventeen-year-old issue.

The general approach here is that, because we do not know the security setup of the webserver, we apply our permission changes to all three digits of the file permission (i.e. user, group and all).

Power users who understand filesystem details may wish disable these protection via a documented configuration in settings.php.