Files by default are world readable, see umask. You tested the exception, a restricted file It's moving files out of potentially-safe directories into definite

Files by default are world readable, see umask. You tested the exception, a restricted file It's moving files out of potentially-safe directories into definitely-not-safe