> It boggles my mind why Magento would willingly distribute unsafe code this way, assuming users would just find out to download the patches separately.

Because Magento are OBSERVABLY INSANE.

This is from the Magento Enterprise tarball. I can't say how much we're paying, but I can say it's public knowledge that it's at least $13,000 a year:

  $ grep -r chmod app | grep 777
 app/code/local/Gorilla/Heartbeat/Helper/Data.php:  chmod($logDir, 0777); 
 app/code/local/Gorilla/Heartbeat/Helper/Data.php:  chmod($logFile, 0777); 
 app/code/core/Mage/Install/Model/Installer/Console.php:   @chmod('var/cache', 0777); 
 app/code/core/Mage/Install/Model/Installer/Console.php:   @chmod('var/session', 0777); 
 app/code/core/Mage/Install/Model/Installer/Config.php:   chmod($this->_localConfigFile, 0777); 
 app/code/core/Mage/Compiler/Model/Process.php:   @chmod($dir, 0777); 
 app/code/core/Mage/Catalog/Model/Product/Attribute/Backend/Media.php:  $ioAdapter->chmod($this->_getConfig()->getTmpMediaPath($fileName), 0777); 
 app/Mage.php:   chmod($logDir, 0777); 
 app/Mage.php:   chmod($logFile, 0777);