I'd personally use 775 since e.g. shared hostings don't provide a separate PHP process per user/vhost which runs as that user. They usually have 1 group which all vhost users and the PHP-FPM pool belong to.

Therefore currently anything not running as that exact user won't have write access to those files/folders.

This is only making it consistent with the other commands/values.
If we want a different approach, we would need to tackle the other occurrences too.

I wonder if this should be configurable or some kind of constant then.

I wonder if this should be configurable or some kind of constant then.

We could add a Configure value for default permissions, and default it to use 777 ^ umask(). That would enable both folks who can control their runtime and those who can't. This may create some more cross package dependencies though.