This is a stupid restriction, malware could write all over %AppData% or %LocalAppdata% as well if they wanted to.
You can change the NSIS plugin directory in NSIS v3+ with this:
PHP Code:
Function .onInit
UnsafeStrCpy $pluginsdir "$localappdata\myappsetuptemp"
CreateDirectory $pluginsdir
FunctionEnd