In most cases, you run that locally before building a transport package that has the vendor directory inside of it.
To run a composer install from a composer.json (and/or .lock) during the installation, you can use a composer resolver like we’ve done here. (Note that requires placing a composer.phar in the core files). Note that this installation approach works well across the vast majority of servers, and doesn’t even require PHP have the ability to run a CLI command.
The additional benefit of that approach is cleanup: package installations normally merge directories, while composer replaces versions entirely. So it keeps a cleaner vendor directory across updates.
In the future it would be great if we could somehow hook into the core and have a single vendor directory with all packages required by installed extras, but as of yet that’s unresolved.