As the 'root_scope' issues are now fixed, here a reworked and enhanced 
(checkbox, setup.rc entry) version of the original patch from this thread.

With the new setting enabled, setup behaves like other install tools 
when run elevated: The installation is then also protected against 
accidental modifications by the current user.

owner:group assignments of newly installed dirs/files:

adm:adm -- "All Users", "[X] Change owner of newly installed files to 
local Administrator"
usr:adm -- "All Users"
usr:def -- "Just Me"

(usr = user running setup, adm = S-1-5-32-544, def = S-1-5-21-*-513)

An alternative for the UI would be a 3rd radio button ("All Users - 
change owner of newly installed files to local Administrator"), but the 
checkbox makes this addition IMO more obvious.

The new setup.rc setting 'root-scope' is only used to read the 
chown_admin setting but this could be enhanced, e.g. warn user if 
root_scope selection differs from previous setup run.

The drawback that files generated by postinstall scripts are still owned 
by current user could be fixed with a perpetual postinstall script. I 
could provide one for base-files package if desired.

-- 
Regards,
Christian