[cflsystems]

Custom modules can modify files only within /classes and /skins directories. Everything else is part of the untouchable XC core.
Everything under /vendor are packages you can pull yourself with composer however depends on the changes between these packages versions some XC functionalities may not work or throw errors. These /vendor packages are not part of XC they are just used by XC.

You can pull phpmailer package under your own custom module and reference it from there instead of the one under /vendor but for this to work how XC uses the package should be under /classes so you can decorate the appropriate class and reference your module package instead.