Как писать в Web.Config со средним доверием?

На самом деле это похоже на уровень IIS Low. Если это так, то вы не сможете писать ни в один файл, а не только в web.config.

Вот уровни из файла справки IIS:

• Full (internal) - Specifies unrestricted permissions. Grants the ASP.NET application permissions to access any resource that is subject to operating system security. All privileged operations are supported.
• High (web_hightrust.config) - Specifies a high level of code access security, which means that the application cannot do any one of the following things by default:
  • Call unmanaged code.
  • Call serviced components.
  • Write to the event log.
  • Access Message Queuing service queues.
  • Access ODBC, OleDb, or Oracle data sources.
• Medium (web_mediumtrust.config) - Specifies a medium level of code access security, which means that, in addition to High Trust Level restrictions, the ASP.NET application cannot do any of the following things by default:
  • Access files outside the application directory.
  • Access the registry.
  • Make network or Web service calls.
• Low (web_lowtrust.config) - Specifies a low level of code access security, which means that, in addition to Medium Trust Level restrictions, the application cannot do any of the following things by default:
  • Write to the file system.
  • Call the Assert method.
• Minimal (web_minimaltrust.config) - Specifies a minimal level of code access security, which means that the application has only execute permissions.

Я бы посоветовал, если вы настроены на установку установщика, пусть он создает web.config в памяти, который пользователь может сохранить локально, а затем FTP.