In Shared Hosting panels they do not support changing the document root of the primary domain hence the above method described of pointing the domain to the public/ folder is not something Softaculous can do.
Hence Softaculous unzips the files in document root BUT Softaculous does protect that directory using appropriate .htaccess rules so the files outside public/ folder when installed via Softaculous are not web accessible.
Regarding the logo for the forum its not that we did not change the logo out of laziness but to give the forum developer the due attribute. I am not sure how that would lead to any security implications as you mentioned in your post.