@stdweird: there's code in place to make installation directories read-only optionally which would take care of that, there's just no option for it yet.

It should be clarified that the umask as a whole only applies to non-leaf install directories (not sure how to express that concisely).