PKG permissions question for homegrown delta updater

I have an existing homegrown delta updater for my electron 3.1.5 app for windows installations, which downloads updated asars and puts them in AppData/Roaming/myapp/myapp/resources/. For mac, I’m using electron-builder to sign and build to a pkg file. I’d like to allow the user to select /Applications or ~/Applications as the install location, but when using the former, they’ll see a permission error (the same error as detailed at How to write within the app) and the delta update will fail.

Per that link, it’s not best practice to modify files inside the app bundle directory. Where should the updater store the asar files it downloads?