The general problem is handled in Graham Miln's answer. This answer is only a slight addition exercised upon the example application given:
Short version: macOS has a few special directories for this kind of behaviour. Those are the global and user /Library paths already mentioned in Graham's answer. But a less visible and hence less obvious path is within each Application bundle.
Some apps are too clever. Vox is a prime example of this. These agents are not well explained but often complained about and thus a potentially unwanted programme, application or software (PUPAS)
This application triggers a chain of events already when it is being copied to /Applications and again when first launched.
Inside the package bundle are LoginItems:
/Volumes/VOX/VOX.app/Contents/Library/LoginItems
../Loop.app
../VOX Agent.app
Both are the copied/registered by the system's own DesktopServicesHelper as an "application helper login item". These kind of "helpers" are often found in other apps as well and are usually just bloat adding nuisances. They might be blocked preemptively from registering in the first place by handy little apps, like BlockBlock.
As these are still contained within the app bundle you would have to search or supply the path to within the app bundle!
A search for automatically launched programmes/helpers has to include /Applications and ~/Applications!
Another annoyance is then found within the app bundle:
/Volumes/VOX/VOX.app/Contents/XPCServices
/Volumes/VOX/VOX.app/Contents/XPCServices/VOX\ Toolbox.xpc
/Volumes/VOX/VOX.app/Contents/XPCServices/com.coppertino.Vox.GNTPClientService.xpc
One way to disable these per-user processes from bothering you is outlined in Graham's answer, using launchctl
.
You just need to search within /Applications as well.
Another method would be to go into the bundle and just delete these items. – Most of the time those apps start fine without them, just missing the respective functionality. Vox was once a nice little 'no-frills' music player. It does work for that without those annoyances present on disk.
Sometimes better designed applications offer you an option to prevent those shenanigans in their preference dialogue.
Personal favorite: In the case of the application in the example given, it would be best to delete the whole application.
To directly answer the quesion headline of
Why can an app create daemons on the fly without sudo permission and how to stop it?
Because a user launches the app with his privileges and daemons contained within that application bundle are then sometimes quite annoyingly designed to then register themselves quite intransparently as "autostart" within that user's context and with that user's rights. To unload or deregister no sudo/administrative rights or permissions are required. If the offender sits under /Applications then removal might depend on higher permissions.