This makes it hard to use the common schema where user X runs command-line scripts, and the webserver runs as user Y, and they both belong to the same group.

I dare say that this is the most common permission schema in use on prod servers, after the one where all scripts are run using the same user as the webserver...

The problem comes from the usage of FlySystemBundle 0.4, which has no settings to allow changing the permissions of the files it creates on disk, unlike the legacy dfs handler.
Upgrading to FlysysyemBundle 1.4 or later does bring in those permissions.