With every installation a different module fails ( the issue is not always related to composer ) and the token should be inserted manually. That is valid for installations as well - not only updates.
When a user installs it via Softaculous , the token should be predetermined. I suppose that you use some default token but github have limited the number of downloads so a single one will not do.