Thanks for a well researched bug report! Could you please also check if this has been reported upstream to MariaDB at https://jira.mariadb.org/?
In the Debian packaging (sources at https://salsa.debian.org/mariadb-team/mariadb-server/-/tree/debian/latest/debian) we are not doing any modifications to the permissions of the socket AFAIK, so this is most likely inherited from upstream as-is.
