Can you check (possibly by another carefully time cron job) what the ownership and permissions for those files are just before sympl-filesystem-security decides it needs to change them?
The implications are bizarre, but as a sanity check I’d try setting it up on a server that’s not Bytemark (anyone who can provide a VPS charged per hour or free for a limited time would do.)