Good question. I honestly have no idea. The kext has to be owned by root:wheel for the system to accept it. Making a pkg installer was the simplest solution I knew of.
VMWare and most applications that do this use Authorization Services. It's what pops up the dialog asking you to enter your password. Feels pretty magic to use it.
The downside to packages (in users' minds) is that you have no idea where the pkg is going to install things, and also no idea how to clean it up later.
It's assumed that an .app, however, will remain self-contained.
I believe smcfancontrol installs its kext by demand from inside the Cocoa App. I don't know how it's done (I only do UNIX stuff on my Mac =/) but I believe it changes the .kext owner and invokes kextload. You can 'sudo' from inside a Cocoa App by using AuthorizationExecuteWithPrivileges:
About PKGs: I think that they're okay, but, historically, they're maligned for being "black boxes" that install files all over your system. App files, OTOH, are (99% of the time) clean, live on /Applications, and sometimes use ~/Library.
