Drush Permissions Issue
Drush does not handle platform-specific issues such as file permissions. To get rid of group write, just run chmod -R g-w /path/to/drupal. If you wanted to do this automatically, you could make a post-update hook for the pm-updatecode command.  See the example Drush pm_update hook file for one example post hook function.

In your case, you would want something like this:

function drush_myhook_post_pm_updatecode() {
  passthru('chmod -R g-w .');
}


Save that in a file named myhook.drush.inc, and put it somewhere that Drush will find it, such as DRUPAL_ROOT/drush.  Then run drush cc drush, and your hook should run the next time you call drush pm-update.