Might be related to, or duplicate of T189560: mediawiki/vendor REL1_* no longer ship dependencies for wmf extensions that are not in the mediawiki tarball.

In particular:

In T189560#4411979, @Reedy wrote:

In T189560#4411903, @dbarratt wrote:

so if you want to have a vendor inside of AbuseFilter we'd have to add something like:

require __DIR__ . '/vendor/autoload.php';

somewhere (I have no idea where this would go).

This is what the following code in extension.json does:

"load_composer_autoloader": true