[[Io]]

Pues parece que ya encontré la solución.

En la ayuda nos dice:

The Pascal script can contain several functions which are called when Setup wants to know the value of a scripted {code:...} constant. The called function must have 1 String parameter named Param, and must return a String value.
The syntax of a {code:...} constant is: {code:FunctionName|Param}

• FunctionName specifies the name of the Pascal script function.
• Param specifies the string parameter to pass to the function. If you omit Param, an empty string will be passed.
• If you wish to include a comma, vertical bar ("|"), or closing brace ("}") inside the constant, you must escape it via "%-encoding." Replace the character with a "%" character, followed by its two-digit hex code. A comma is "%2c", a vertical bar is "%7c", and a closing brace is "%7d". If you want to include an actual "%" character, use "%25".
• Param may include constants. Note that you do not need to escape the closing brace of a constant as described above; that is only necessary when the closing brace is used elsewhere.

Example:
DefaultDirName={code:MyConst}\My Program
Here is an example of a [code] section containing the MyConst function used above.
[code]
function MyConst(Param: String): String;
begin
Result := ExpandConstant('{pf}');
end;

He probado este código y funciona:

[Setup]
AppName=Usuarios
AppVerName=Usuarios 1.0
AppPublisher=Rm&Monge@Galocha
AppPublisherURL=http://www.example.com/
AppSupportURL=http://www.example.com/
AppUpdatesURL=http://www.example.com/
DefaultDirName={code:GetDirect}
DefaultGroupName=Usuarios
OutputDir=C:\basura
OutputBaseFilename=Security_Setup
Compression=lzma
SolidCompression=yes

[Languages]
Name: spanish; MessagesFile: compiler:Languages\Spanish.isl

[Files]
Source: D:\PROYECTOS\Rota_SQL\seguridad\security.exe; DestDir: {code:GetDirect}; Flags: ignoreversion

[Icons]
Name: {group}\Usuarios; Filename: {app}\security.exe

[Run]
Filename: {app}\security.exe; Description: {cm:LaunchProgram,Usuarios}; Flags: nowait postinstall skipifsilent

[-code]

var
  Dir :string;

function InitializeSetup(): Boolean;
begin
  result:=True;
  Dir:='';
  if RegQueryStringValue(HKEY_LOCAL_MACHINE, 'SOFTWARE\RM\ROTA_SQL\APLICACION','Path', Dir) then
    if Dir <> '' then
      Dir:=ExtractFilePath(Dir);
end;


function GetDirect( p :string):string;
begin
  if dir <>'' then
    result:=Dir
  else
    result:='c:\basura\usuarios';
end;

Bueno este código ha sido lo primero que me ha venido a la cabeza, pero la duda que tenía, se ha despejado.

Bueno Aquí queda dicho, por si le interesa a Alguien.

Chao.