You download the .bz2 file and unzipping creates a new archive whose unzipping brings you a second .bz2 file. You need to Google and find this thread https://community.apachefriends.org/f/viewtopic.php?f=29&t=80458 which has probably been viewed a million times to learn that you have to rename the extension to DMG. I do not see any obvious reason as to why you'd make the file a .bz2 to begin with.
Opening this file presents you with XAMPP.app whose naming convention leads you to dragging the .app into your /Applications folder. As soon as you launch it you learn that it should've been named ..Installer instead of XAMPP.app since it's not the actual package.
Just my 2 cents, I don't understand the reasoning behind these 2 decisions