how... it's packed into the exe... so that it can install it... how else would I do it?
It's not super advanced, just checkout NSIS if you're wondering about the basics of NSIS.
I'm working on phasing out NSIS though, so none of this is valid for much longer, but ofc the files get bundled in the installer itself so that the installer can actually do its job. I don't know how much more I can say... you've seen the folder bundled and the script that's used to compile the installer. Nothing much more I can say about the installer.
If you still don't trust it, sorry, but either you're on your own or you need to download the full 7z archive to update. I won't distribute a 7z and bat bundle ever again, that didn't end well when I did it, so not gonna do it again. Nor do I plan to use double the time to design the updater, having one installer and one 7z/bat for every update. There isn't demand for the latter, I don't like it and people think cmd = virus. there's literally no upside to doing it that way.
I'm plenty open to explaining what I'm putting in the installer and what exactly it's doing, and I even give the source on request like I did here, that would be the fifth or so time I've gotten a source request, and all times I've given it. And NSIS is incredibly easy to reverse engineer, so I don't imagine doing anything dodgy there would go under the radar.