The "Add Auditors" action in Diffusion only allows users in the typeahead. This is probably trivial to fix but might be a little bit involved. In theory, projects and packages should both be allowed.
The use case in question was just around projects, not packages, so supporting projects as a halfway step would be good even if packages are more complicated.