Click-Once keeps the app on the server (when you want an online-only app)
Users see nothing on their desktop or start menu. The app runs after installing once.

Because you check versions, hacked versions won't run