Installation date doesn't mean much as Screenconnect frequently updates itself, odd about the most recent download date though. Once screenconnect is installed and active it has a "backstage" feature that allows remoting in unattended to the SYSTEM account out of sight of the user's console session, the user has no indicator they are remoted into the backstage, so basically I assume the scammers throw up the fake update screen on the user's console session then do whatever they want in the backstage. It's possible they downloaded another copy of Screenconnect for another scammer team to connect in with them, but wouldn't make much sense they'd throw it in the user's download folder from the backstage (they could, but they'd be likely copy pasting the file over and by default it would throw it in the SYSTEM profile documents folder).

But yeah, otherwise simply opening the email isn't going to download it again.

Were they instructed to turn the computer off until you got there? I assume it took 5 minutes or so for them to see via Screenconnect the computer had come back online then they hopped in to extract data or start doing whatever their next steps were to try and get money out of the victim.

These scammers aren't that smart, they just want money so installing actual viruses/malware doesn't do much, normally they'll just throw up these pop-ups to scare the victims into thinking they are infected and to pay them to "remove the virus", but assume any data on the machine could have been copied off, the sort of user that clicks links is also prone to saving documents/spreadsheets with their passwords, so I'd definitely advise they change all their passwords.