Exe installers in general, and nullsoft and inno in particular create windows installers that are non standard. Please do not use them. Please only make .msi installers. I have to deploy 1000's of apps across our network, and .exe installers cause so much pain. If you are going to have have some sort of .exe installer, please ensure that you document how to run the installer in a quiet way, and how to customise the installation from the commandline.
At the very least, it can be deployed in a scripted way and added to an OS install image without having to mess with each installer's command line options individually, and can be installed to an entire fleet of machines via group policy.
If you have a malicious dll and an installer in your download folder, the exe will (potentially) automatically run the malicious code. (And what kliment said)