That location is protected by the OS with inherited properties. If you have logged in as an administrator, then you can manually delete them by temporarily elevating your privileges (right click delete with shield icon).
An installer would request that during installation which is how the files and folders get there.
Running things i.e. an add-in with those elevated privileges is probably not a good idea. I don't even know if it is possible for an add-in. I know how to write an executable that requests elevated privileges, but I assume the host to the add-in (Revit) isn't run with them.
"Besides that, why is Revit using the dll file when the app bundle loads the addin on start up by default?"
Which alternative were you expecting? That is one of the locations Revit looks in. That aspect is another reason you may not be able to delete it whilst Revit is running.
My overall advice is that installers have uninstallers so best to use that or the thing will forever feature in your 'add/remove programs' window. Probably sorting out and testing the contents of the app exchange package is one of the last tasks to do. If your add-in saves files where the dll is located (at runtime), you should think of another location for those items i.e. you have known user folders (special directories) that can be written too instead of where your dll sits.
Debug.WriteLine(Environment.GetFolderPath(Environment.SpecialFolder.ApplicationData))
Debug.WriteLine(Environment.GetFolderPath(Environment.SpecialFolder.LocalApplicationData))
Debug.WriteLine(commandData.Application.Application.CurrentUsersAddinsDataFolderPath)
Debug.WriteLine(commandData.Application.Application.CurrentUsersDataFolderPath)
C:\Users\<User>\AppData\Roaming
C:\Users\<User>\AppData\Local
C:\Users\<User>\AppData\Roaming\Autodesk\Revit\Autodesk Revit 2023\AddinsData
C:\Users\<User>\AppData\Roaming\Autodesk\Revit\Autodesk Revit 2023
I can think of an updater that looks for and loads an alternative dll from one of the above locations but that seems like a poor security choice since the folder isn't protected like the ProgramData one is (who knows what the contents could be). I guess in that scenario you could check the certificate of the dll to validate it is your update. However write an msi/exe that updates the contents of ProgramData seems the best simple option since that needs permission.