The installer log view showed that a File Not Found error was occurring in /private/tmp.
Inspecting directly, /tmp was a symlink to /private/tmp, which itself was a symlink to private/tmp, that is to say /private/private/tmp! This target did not exist. The erroneous symlink had a modification date in 2016, which made me suspect a problem relating to Migration Assistant.
I think System Integrity Protection was preventing me from modifying /private/tmp, even as sudo and with System Preferences > Security & Privacy > Full Disk Access granted to Terminal.app . I didn't really want to disable it.
In the end I just created the missing target sudo mkdir -p /private/private/tmp and the installer worked.
It'd be nice to know how the erroneous symlink came into existence. The Migration Assistant theory is just a theory at this stage.
addit
Problem recurred while upgrading to macOS 10.15.4 (presenting with An error occurred while updating firmware.). Booted into recovery mode and inspected /Volumes/Macintosh HD/private/ to find that my ./private/tmp directory wasn't there any more. SIP seemed to be off so I could just remove the ./tmp symlink and create a real ./tmp directory. Then upgrade worked!
Hopefully this will be a more durable fix.