Should the comment

# Default: PKGVULNDIR="${DISTDIR}"

really be changed so at build time it is replaced with whatever the  
value of DISTDIR
was when make was run?  The comment left in-tact seems to suggest  
that you can
use things like ${DISTDIR} in the configuration after installation.   
Of course since
audit-packages and download-vulnerability-list do not expand such  
vars thats not
the case.

So more like files/audit-packages.conf

# Default: PKGVULNDIR="@PKGVULNDIR@"

and then enable the sed magic at package build