I believe we've actually mitigated this already in XF 2.2.6 due to the changes we made in this bug report:
[URL unfurl="true"]https://xenforo.com/community/threads/add-on-composer-support-seems-inefficient.193651/[/URL]
This has changed the error handling in such a way that you can't actually install or upgrade an add-on any longer that has a missing composer directory that has been defined.
When installing from an archive, the install gracefully fails and is reported on the results page.
When installing from the CLI or the Admin CP when the files have been uploaded, an exception is thrown.
That applies with debug mode enabled. If you don't have debug mode, the failures are silent, errors are logged, and the composer autoload isn't set up.
This will obviously result in other errors if the code calls unloaded packages so we need to make sure there's a build-time check for the composer path too so consider that done for the next release as well.
