The goal is going to be not requiring SSH. I'm going to have a packaged version that includes the /vendor directory already populated, so that should eliminate the need for running the composer install.
In terms of needing to point to the phpvms/public directory... I've found that placing phpvms in the same directory as public_html, and then creating a subdomain (e.g, a www subdomain) and pointing it to the phpvms/public directory works. Then you can create a CNAME for the base domain to point to www. I think that should cover the install on a shared host. I'll be asking people to test this out in the alpha version. It is annoying, yes, but all modern frameworks are working this way now. The biggest advantage is security... especially with addons. With the code not being exposed, the chances for any attack are minimal. Luckily there haven't been any (except for a while ago due to a 3rd party library), but there are some that would definitely be vulnerable.
If you have SSH access, you can create a symlink from public_html to phpvms/public, and then you don't need to worry about any CNAME stuff. One think I need to investigate is if you're able to do this from cPanel.