IMHO, it's a bug.
0444 means: owner user has read permissions, owner group has read permissions, everybody else has read permissions.
0644 means: owner user has read and write permissions, owner group has read permissions, everybody else has read permissions.
Both permissions allow EVERYBODY to read the contents of configuration.php. Depending on your server configuration this is a feature (shared craphosts) or a glaring security hole (properly set up server with isolated users). The first set of permissions doesn't allow the site owner to edit the configuration while the second allows him to do it. In other words 0444 permissions deal with no security issue whatsoever. No hacker will write to the configuration.php file (it's stupid and futile). They will instead read it so that they can get access to your database (= modify your content = profit for the hacker/spammer!) or even get access to your FTP account (= full access to your site's files = spam static HTML pages = really effin' huge profit).
So, no, 0444 permissions is not a feature. It's a bug introduced by those who think they understand web security. Secure permissions would be 0600 but only if the site was running under a dedicated user, e.g. suPHP or mod_itk was in use. Otherwise the permissions should be left alone and the site owner should decide what's the best combination. Simple and secure.
Nicholas K. Dionysopoulos
Lead Developer and Director
🇬🇷Greek: native 🇬🇧English: excellent 🇫🇷French: basic • 🕐 My time zone is Europe / Athens
Please keep in mind my timezone and cultural differences when reading my replies. Thank you!