Why does the files directory ignore system wide umask? I have a Debian test system running Nginx and PHP-FPM, and have set a system wide umask of 027 which translates to default permissions of U=RWX G=RX O= for directors and U=RWX G=R O= for new folders and files, respectively.

After running the Drupal installer and reviewing directory structure, I notice that the installer generated files directory has default permissions of U=RWX G=RWX O=RX.  Any files uploaded to this directory also receive similar permissions.  Why is this so?  Is it hard coded into the software to provide such permissions?

It would seem that if any new folders of files created in the files directory will receive hard coded permissions, that you would need to regularly update those permissions to something of your choosing.
Yes, if Drupal has permission to write to your doc root then it will certainly create the files folder on your behalf during installation, and attempt to set sensible permissions on it (775 seems perfectly reasonable to me considering the web server itself is creating the folder). This all happens in the /includes/install.inc file.

If your server is secured correctly, though, this should not be able to happen. The web server user should not be able to write to the doc root, only to the public/private filesystems. So you would create the files folder manually, and whatever permissions you decide to grant become part of that process.

See Securing file permissions and ownership for a full set of instructions on properly securing a Drupal site.