Developers use Composer to manage libraries. If a developer runs composer require --dev phpunit/phpunit , it installs PHPUnit only for local development.
Ensure your vendor folder is NOT inside your public web root (e.g., public_html or www ). It should be one level above. Developers use Composer to manage libraries