I think the intent here was to use osquery for auditing, but it wasn't finalized, so they left auditd enabled.