When the setgid bit is set on a directory, all the files created inside it should get the group of that directory.
The MariaDB server itself appears to observe this rule.
However, the mariadb-upgrade utility does not. With datadir=/var/lib/mariadb:
I think the mariadb-upgrade tool should follow the normal convention regarding the setgid bit on directories.
Note that if the setgid bit is set on the actual datadir's mysql folder, then mariadb-upgrade seems to behave as expected.