I ran into this bug as well and checked if it's also present in Debian. It appears that from spamassassin 3.4.0-2 the relevant code is:
# Update umask 022 env -i LANG="$LANG" PATH="$PATH" start-stop-daemon \ --chuid debian-spamd:debian-spamd --start \ --exec /usr/bin/sa-update -- \ --gpghomedir /var/lib/spamassassin/sa-update-keys 2>&1
When using start-stop-daemon to invoke sa-update the umask is not changed, so updating to this version will fix the bug.
I ran into this bug as well and checked if it's also present in Debian. It appears that from spamassassin 3.4.0-2 the relevant code is:
# Update spamd:debian- spamd --start \ spamassassin/ sa-update- keys 2>&1
umask 022
env -i LANG="$LANG" PATH="$PATH" start-stop-daemon \
--chuid debian-
--exec /usr/bin/sa-update -- \
--gpghomedir /var/lib/
When using start-stop-daemon to invoke sa-update the umask is not changed, so updating to this version will fix the bug.