You didn't say what OS (MacOS or Windows) or version of same you are running under and/or whether the directory under which the package is being sent is being stored is on a server or local storage.
However, some considerations:
(1) Once InDesign finishes the packaging operation, it does not hold or control that directory in any manner. Thus, if you remove the read only attribute of the directories and files, it isn't InDesign that is somehow resetting same.
(2) We are not aware of any such issue with the CS4 version of InDesign based either on internal or customer reports.
(3) You may wish to check the properties of the underlying directory in which the package is being created and see if it has any unusual protection attributes including propagation of security attributes which conceivably would or could be inherited by the new package directory.
Beyond that, you are dealing with software that is 10 years, is at least seven versions behind the current version, and no longer supported by Adobe.
As Dov says: Indesign is not taking a hold on the protection structure for files and directories. In the contrary. It uses, when you open an Indesign file, its own locking mechanism, making that you cannot open the same file your workmate has open. But there is no problem making a copy using the OS support.
May be you should try to create manually some directories and files and see if they behave the same. There surly is a simple explanation without involving Indesign.
May be you should ask this in a MacOS forum?