I think the typical user sees a .dmg as a folder and the application icon as a shortcut, much like users get confused about opening a .zip and trying to operate on the files they see without extracting first. Neither of these are technically true, but the two mental models end up making sense with the action in the end.