The code in the postinstall package for bind-9.1.3-3 creates rndc.conf without resetting its group and permissions properly. It should call "chmod 640 /etc/rndc.conf" and "chgrp named /etc/rndc.conf" after creating it.
This is fixed in 9.1.3-4 and later.