Yep, that is done on purpose since setup.php is a security risk (so, if need to do multisite, then need to download the script, use it, and then should remove it after).
EDIT: correct that patch does not need setup.php. Only reason for using setup.php after an installation is for multisite.