The installer doesn't set proper permissions on tmp files right away. Line numbers are from current git master, but it's also present in froxlor in Factory

  342                         chmod($userdata_file, 0440);
  343                 } elseif ($fp = @fopen('/tmp/userdata.inc.php', 'w')) {
  344                         $result = @fputs($fp, $userdata, strlen($userdata));
  345                         @fclose($fp);
  346                         $content .= $this->_status_message('orange', $this->_lng['install']['creating_configfile_temp']);
  347                         chmod('/tmp/userdata.inc.php', 0440);

  On my system that means that the file is created with 644 permissions and
  is world readable for a while
  -rw-r--r--  1 wwwrun   www    391 Mar  4 17:03 userdata.inc.php

  Proper permissions should be set before the content is written.