A .app can install a persistent service or alike just as easily as a .pkg. Unless the .pkg is from a untrusted source but the .app is signed. But then again why even install from an untrusted source without signature.
I also chown + chmod LanchAgents and LauchDaemons in both libraries so that only root may write to it.