The average WordPress user has no clue what a file permission is. This probably makes up more than 90% of WP users. They start looking for a hosting provider and find companies like Network Solutions or Go Daddy who are advertising special "WordPress" labeled packages with easy 1 click install. If Network Solutions' script installs WordPress or any other script then leaves the config file with insecure permissions set then that is a Net Sol problem.

Fantastico Deluxe leaves the config file at 755 and I am sure there are tons of hosts out there who are not running suPHP and advertising Fantastico as a feature for easy WP installs. Most users don't even think twice about this.

So my conclusion is that WordPress should probably do a better job of educating average users and Hosting providers who offer 1 click installs better have the install script and the shared server environment securely configured.