You didn't say what OS (MacOS or Windows) or version of same you are running under and/or whether the directory under which the package is being sent is being stored is on a server or local storage.
However, some considerations:
(1) Once InDesign finishes the packaging operation, it does not hold or control that directory in any manner. Thus, if you remove the read only attribute of the directories and files, it isn't InDesign that is somehow resetting same.
(2) We are not aware of any such issue with the CS4 version of InDesign based either on internal or customer reports.
(3) You may wish to check the properties of the underlying directory in which the package is being created and see if it has any unusual protection attributes including propagation of security attributes which conceivably would or could be inherited by the new package directory.
Beyond that, you are dealing with software that is 10 years, is at least seven versions behind the current version, and no longer supported by Adobe.
- Dov