I wonder if it’s wrong to have osquery create that directory. I can argue either way

To me it seems better to have osqueryd create the directory if it doesn't exist, than to just become disabled from running