So I could write a script which looks for the .cookie file and once it is created by bitcoind changes group and permissions. systemctl would have to wait for this script to finish before bringing the indexer back up since its user needs the permissions to work properly. I just though there is an easier way provided by bitcoind itself, as I thought that's the whole point of the .cookie file.
Take note of the above reference. Especially the systemd config:
https://raspibolt.org/guide/bitcoin/bitcoin-client.html#autostart-on-boot.
What you need is the
-startupnotify="chmod g+r /home/bitcoin/.bitcoin/.cookie" parameter.
The startupnotify option is used to specify a command to execute when Bitcoin Core has finished with its startup sequence. (#15367)
And I don't think you need a separate bitcoin group. You just need bitcoin:bitcoin, and only assign the .cookie file as group readable, with the above command.