The default file and directory-rights set by postgesql for the data
directory are such, that anybody has the right to read, write and delete
files.
The installer as well as initdb should set reasonable rights or the user
should at least be warned that he should adjust the file and directory
rights.
Regards
Christoph Becker