Though this is an old issue, I would like to bring it up once more. I am using InnoSetup 6 and have spent two days working on this until I found this stackoverflow issue. For me it seems that the problem is still there. My installer keeps crashing with an Access Violation and I boilt it down to a very similar example like the one above. It makes no difference if I use createElement or createNode.
xmlDocument := CreateOleObject('MSXML2.DOMDocument.6.0');
xmlDocument.async := false;
xmlDocument.resolveExternals := false;
xmlDocument.loadXML('<broker><web bind="http://localhost:8161"></web></broker>');
//xmlDocument.setProperty('SelectionLanguage', 'XPath');
// Select the <web> node
node := xmlDocument.selectSingleNode('/broker/web');
// save attribute value into variable
bind := node.getAttribute('bind');
// remove legacy attribute
node.removeAttribute('bind');
// add new <binding> element as first child of <web>
//newNode := xmlDocument.createNode(1, 'binding', '');
newNode := xmlDocument.createElement('binding');
newNode.setAttribute('uri', bind);
Log(Format('### Appending %s as first child of %s', [newNode.xml, node.xml]));
node.appendChild(newNode);
Log(Format('### Inserted %s as first child of %s', [newNode.xml, node.xml]));
xmlDocument.Save(bootConfig);
All I see when running the code above is this:

The difference with createElement and createNode is, that createElement creates the exception message above and createNode simply kills the installer silently.
The last I see in the logs is this line:
2022-04-25 13:44:47.597 ### Appending <binding uri="http://localhost:8161"/> as first child of <web></web>
2022-04-25 13:44:47.597 CurStepChanged raised an exception.
2022-04-25 13:44:47.597 Exception message:
2022-04-25 13:44:47.597 Message box (OK):
Runtime error (at 211:2827):
Access violation at address 03CC8380. Execution of address 03CC8380.
Has this been addressed in some way? I cannot see from Russel Jordan's site that there has been any bugfix for this.