Right. But Chrome allows you to do that if the administrator has enabled it. To handle that securely, though, would likely require a specifically restricted daemon or setuid process that is well beyond most normal update use cases. And that might explain why they couldn't just use Sparkle.

The point is this shouldn't need to be done. If an administrator has installed an app, then it's the administrator's responsibility to update it. If I want to update an app myself, I'd install it in ~/Applications instead.