Extensions should not be depending upon phpunit/phpunit, instead they should use the version provided by MediaWiki core. While we generally try and keep versions of dependencies in extensions' composer.json, phpunit is difference since it is closely tied to MediaWiki core with stuff like MediaWikiTestCase, the phpunit.php wrapper, and so on., so we keep it centrally managed.
https://codesearch.wmflabs.org/things/?q=phpunit%2Fphpunit&i=nope&files=composer.json&repos=
(MediaWikiFarm does things very differently and should probably be skipped for the purposes of this task)
Patches cleaning this up: https://gerrit.wikimedia.org/r/#/q/topic:rm-phpunit
There was also some discussion on https://gerrit.wikimedia.org/r/#/c/411553/ about how this needed a Phabricator ticket.