I will not pretend that I understand the details of all the security checks that are made during the process. The QuickOPC code basically calls a code based on the UA Stack and SDK from OPC Foundation, which in turn locates and runs the certificate generator.

My understanding is the same as you have described. The permissions needs to be such that the certificate generator can be found, and then executed, and such that the generated certificate can be stored to its target location (by default, one of the Windows certificate stores).

From what I know, this last step is probably the most sensitive one, and this requires the highest permissions, because it effectively changes the security of the system to trust more - in this case, so that certain apps will trust other apps that use the certificate.