When creating directories and files, the permissions need to be set so that the web server can read them. This is handled properly when creating new directories, but not when creating new files.
I think that the proper place to do this is in imageapi_image_close, rather than hook_image_close, because the file permissions issue seems more like a generic web server issue, than a specific toolkit issue. If you do it there, then it only needs to be done in one place, than but maybe you have other ideas.
Patch is attached.