It appears that the mode for libdir is set during pluginsync, to the mode of the lib/ directory of some module being synced (apparently whichever comes first). However, the owner and group are always set to root. This means that a module which is readable only by puppet in the modulepath becomes readable only by root in the libdir. That causes problems for users who install modules with restrictive umasks and wish to install plugins for the puppet master, since it isn't actually allowed to load them from the libdir (and require won't find them in the modulepath).
Worse still, the mode is set separately from the standard settings catalog, which means even overriding it in puppet.conf will cause it to be set correctly and then changed later by pluginsync.