There's likely an "updater service" that runs with elevated privs that's used for all kinds of other nasty stuff. Windows task scheduler is full of stuff like this if you know where to look, and plenty of hidden services on Macos.

The problem is that there haven't been good enough native ways to do updates & maintenance on installed applications, at least in the past, so this type of stuff became acceptable and commonplace.