When I push upgrades to organizations that have already installed my applications, new Apex Classes and Custom Fields get created by a user with the 'Package Manager Profile' even though the package was originally installed by a user with the 'System Administrator' profile.
This means all of the Visualforce components that we push through the 'Push Upgrade' feature are not visible to users of the client org, because no one in the client org has the 'Package Manager' profile. The only way to give them access is to bundle in PermissionSets and assign those to every user in the org, which seems intrusive.
This problem does not occur if a SysAd in the client org installs the upgrade via the installation link.
Is this a bug in the 'Push Upgrade' feature? If a client has already given our package certain permissions during installation with his 'System Administrator' profile, shouldn't those permissions continue during future pushed upgrades?