Error: Class "Symfony\Component\Filesystem\Filesystem" not found

It wasn't a permissions issue on the root vendor directory.

A version of the Filesystem class is indeed in core, but the PrivateFiles.php check in this module wants to use the Symfony version:

<?php

namespace Drupal\security_review\Checks;

use Drupal\Core\Link;
use Drupal\Core\StreamWrapper\PrivateStream;
use Drupal\security_review\Check;
use Drupal\security_review\CheckResult;
use Symfony\Component\Filesystem\Filesystem;

/**
 * Checks whether the private files' directory is under the web root.
 */
class PrivateFiles extends Check {
...

So as a workaround, I had to require the component in Composer ('composer require symfony/filesystem') to get that specific version of the class into my codebase.

If the check should be using the Drupal core version, not the Symfony version that is stated, then I would think that last use line of PrivateFiles.php needs updating to:

use Drupal\Core\Component\Filesystem\Filesystem;

I wasn't the author of the Private Files check, so I don't know which is the correct version of the Filesystem class to be used by it.