The fault was the committed vendor directory. Especcially if a vendor is retrieved via git a whole git clone of the vendor is performed. Then if you commit your changes, all get added except already added files from another git repo.
Simple: Never commit vendor to a VCS. You have composer and with a committed composer.lock everyone will get exactly the same version.
And if you have to change a bundles code, fork it and load the code from your fork!. And later if the change affects the bundle in general, create a pull request to the original ;)