/bin/cp -PR "$(srcdir)/IDLE/IDLE.app" "$(DESTDIR)$(PYTHONAPPSDIR)"
It is thus created with whatever permissions were set in the source directory. If the source has no access for group or others set, as in the 3.12.0 release tarball, so will the installed IDLE.app.
The Makefile target should ensure that good permissions are set.