I was a bit confused when I wrote this up, trying to remember the state of play within both ocPortal and Composr, when both were divergent.
Composr actually uses the addon.inf for good reasons. Having the registry hook there implies a trust to run PHP code. We can't have it so that every third party who generates a theme or language pack has to be trusted with a PHP file in their addon.
addon_install_code.php is not strictly necessary but it is a nice little feature to have simple code execution without having to build a proper registry hook.
Composr actually uses the addon.inf for good reasons. Having the registry hook there implies a trust to run PHP code. We can't have it so that every third party who generates a theme or language pack has to be trusted with a PHP file in their addon.
addon_install_code.php is not strictly necessary but it is a nice little feature to have simple code execution without having to build a proper registry hook.