Good catch.
root@debian:/# umask
0077
This image of Debian was hardened to the CIS benchmarks.
I think we did both Levels 1 and 2, and I'm pretty sure that was one of the hardening steps (It was like 6 months ago so my memory isn't 100%).
Another issue I identified later after making these...