I'll post my thoughts on the benefits of developing under vendor via a git repo in composer.json instead of app/code ...
Primarily, I don't have to think about where my code resides in dev vs. integration vs. production. It's always in the same place, organized/managed by composer. This simplifies many common developer tasks. For example,
Searching - If I'm searching on a string across the code base, I can just grep/ack in ./vendor. I don't have to search in app/code and vendor, or from a common root dir and search perhaps many unwanted dir. Similarly, for find, whether I'm looking for all cron_tab.xml files or all js files, I just have to look in vendor.
Debugging - I don't have to map different paths in my IDE for debugging in dev vs. integration vs. production. Once again it's always in vendor using a consistent path - not certain paths are in one dir and others are in a different dir depending upon the stage.
Patch files - If I'm deploying to Magento cloud and applying a patch/hotfix, my generated paths will always be correct. I won't have to create a patch file, and then update the paths.
Composer scripts (pre|post-autoload-dump, post-install-cmd, etc.) - since I keep those scripts in a composer module, when referencing them in composer.json, I don't have to update their paths for the different stages.
Shell cmds, cli snippets, etc. in a terminal - if the paths are the same, I can run them in the same way with a simple cut and paste in every stage.
Finding differences between dev vs. integration vs. productions becomes as simple as scp/rsync
and diff -r
(or any other gui diff tool)
What hasn't been a problem for me - composer clobbering my files. I'm not often running composer update while I'm actively developing a module. However, I am frequently committing my code, so it's in git if something should happen. Also, composer will always alert you to changes that could be clobbered, and you have to assert affirmatively that you want composer to overwrite those changes. Lastly, any code that I'm actively working on is also usually open in my IDE, too. If it detects a change, it'll ask me if I want to load the new or old. I'm not sure that I've ever lost code to composer clobbering, but yes, it could happen.