This feels like an old school error, just with modern protection code.

Like in the Win95 days where the installer would ask for a serial number to install... But you could load the installer in a hex editor, look for the PKZ magic bytes, and run unzip on it. :)

i spent a day analyzing enigma protector

Bro, that was already broken in 1945. /s

Did I get this right? The enigma-stuff works good but the devs of the protected VST plugin messed it up by protecting the installer instead of the payload?

Or is this is inherently a problem of enigma?