Even worse when they don't copy it off the DMG. Just leave the DMG mounted.. forever.
Maybe the issue could be ameliorated with a self-updater built-in into the app? Not a separate daemon, but something that by running inside the app, would be able to know what's the path of the old version that should be thrown away.
Still, there's the possibility of users clicking "Cancel". Even then, it's a bit more code to write, test and pay for (from the POV of a client).
Wrapping the bundle inside a .pkg instead of a .dmg solves the problem "for free".