While Milliways' answer is correct in stating that
/boot is a FAT partition and its file access permissions work quite different from unixoid filesystems that is not why
600 permission. That is in fact by design and by the way a perfectly valid permission setting for Raspbian Strech - and working WiFi (I am typing this while being remotely logged into a Pi Zero via WiFi and a
But how come we know that its perms are
600 after Raspbian moving the file from
/etc/wpa_supplicant/? That is because it's explicitely in the code.
raspberrypi-net-mods.service that is doing the trick. It is moving the file and sets the permissions to
600. Given that it contains your WiFi credentials in plain text it might be wise to not have
other) read permissions on it.
This is the actual code:
ExecStart=/bin/mv /boot/wpa_supplicant.conf /etc/wpa_supplicant/wpa_supplicant.conf
ExecStartPost=/bin/chmod 600 /etc/wpa_supplicant/wpa_supplicant.conf
... and some related further reading: Creating /boot/ssh and /boot/wpa_supplicant.conf (for a headless setup) works, but how?.