%users has a NOPASSWD grant on a directory that nothing in the repository ships or manages.

Location
src/etc/sudoers.d/vyos:56

Problem
Grant on a directory nothing in the repository ships or manages.

Impact
Anything placed there is root for every user.

Suggested fix
Remove the line, or ship the directory 0755 root:root with documented contents.