Why can 'Others' read settings.php by default? By default, settings.php has its permissions set to 404, which means 'Others' can read the file. Why not set it to 400, so that only the user can read the file? Thanks.
The reason for this default, I believe, is because on some hos plans (e.g. bargain basement shared hosting), the web server user is not by default the owner of the file.  On some hosting plans, it may not even be an option to use commands such as chown and chmod to set up things exactly the way you want.

The web server user must be able to read this file to get access to DB credentials, and on such hosting plans, allowing "Other" to read is the only way to achieve that.  (Having 400 as the default would most certainly create a deluge of support requests from people unable to figure out why Drupal can't access their database.)

If you know what you're doing, it is OK to 1) make sure the file is owned by the web server user, and 2) set permissions to 400.