The "(I)" flag in an icacls entry means it's inherited from the parent directory. The installer doesn't override these inherited permissions. Currently, it's your responsibility to do this if you install to a custom directory such as C:\Python36. 

Starting with Python 3.5, a per-machine installation defaults to a subdirectory of Program Files. This system directory only grants standard users generic read and execute access for subdirectories and files. A per-user installation defaults to the user's Programs directory (i.e. %LocalAppData%\Programs). This directory grants full control to the user, administrators, and the system. Other users have no access.