I have a Debian test system running Nginx and PHP-FPM, and have set a system wide umask of 027 which translates to default permissions of U=RWX G=RX O= for directors and U=RWX G=R O= for new folders and files, respectively.
After running the Drupal installer and reviewing directory structure, I notice that the installer generated files directory has default permissions of U=RWX G=RWX O=RX. Any files uploaded to this directory also receive similar permissions. Why is this so? Is it hard coded into the software to provide such permissions?
It would seem that if any new folders of files created in the files directory will receive hard coded permissions, that you would need to regularly update those permissions to something of your choosing.