Dk my experience is exactly the same as yours for any and all apps that use the OS X installer and that incudes OS X 10.6.7. However, there is no password required to install drag and drop apps so I suppose that if one were determined enough it would be possible to craft a downloader that could perform the equivalent of a drag and drop install.
I don't know about you but I am turning off the "Open 'Safe' files after downloading" option in Safari — at least until Apple releases the promised security patch.