Just thought I'd jump in here and provide some clarification. We will not raise a non-conformance during your audit if you haven't done a vulnerability assessment which includes packaging.
Firstly, just to confirm that you are not required to complete a vulnerability assessment on primary packaging materials.
The requirements of clause 5.4.3 only applies to food raw materials. In fact the whole of section 5.4 applies only to food raw materials.
However, clause 3.5.1.1 does require your raw material risk assessment to consider substitution or fraud for primary packaging.
You'll also notice a typing error in the Standard here, where it incorrectly refers you to clause 5.4.2 but it should be 5.4.3.
So as part of your raw material risk assessment you do need to consider such risks.
It does not need to be the in-depth vulnerability assessment that you are required to do under 5.4.3 - so you don't need to include the mandatory requirements of historical evidence of substitution or adulteration, economic factors which may make adulteration or substitution more attractive, ease of access to raw materials through the supply chain, sophistication of routine testing to identify adulterants and the nature of the raw material.
However you will need to consider vulnerability more generally of those packaging materials. This could be very simple such as just being based on the supplier you are using and the nature of the packaging and whether any claims are made (e.g. recycle content, eco claims etc).
The other thing is, for food raw materials you need to review the vulnerability assessment annually, but for primary packaging because it's only done as part of the raw material risk assessment you only need to review this every 3 years.