Your skepticism and caution are commendable.
The application requires your system password to install the update - this shouldn't be necessary, and at best it would seem to be unnecessary hassle incurred by programmers who didn't bother to make their app drag-and-drop installable.
At worst, they could use your password for something nefarious - this is why you're doing good to be careful with your password when dealing with software/developers you don't trust.
The good news is that when the application isn't running and dragging it to the Trash requires your password, it's almost certainly the Mac OS X Finder that requires the password because the application files were installed with weird permissions settings.
In other words, dragging something to the Trash is a Finder action, and if you need to enter a password to do so, it will remain with the Finder - a trusted application.
If you click on the little "Details" disclosure triangle, you can see exactly which process requires authentication - in the case of a permissions issue in the Finder, it says something like
Right: com.apple.desktopservices
Application: Finder
and if you click on the application, you can see *exactly* where on your hard drive it's located.