I think you do misunderstand. My point is that upgrading an application should not change existing users' permissions or other configuration matters.
These are set by the user of the machine and should remain as set.
What the script does is reasonable for first installation, but not for an upgrade, where the user would expect the set-up to remain.
I have created a user for a special purpose which is exposed to the Internet, so I want to lock that user down, and I don't want my work undone at every upgrade.
What I think is needed is a test of whether vboxusers already exists, and if it does, just leave it as it is.