The generated package.xml doesn't include task for replacing @package_version@ for each file. Although the code generator uses addReplacemenet method which is supposed to add the replace task but this is not working. More resources that would help in the investigation:
generated package.xml example with replace task
generator for the above package
per discussion this pertains to what we commit on GitHub as well. Composer pulls in directly from GitHub, but some people might just fork the repo. So we should not rely on PEAR doing this replacement, but should maintain the code without @package_version@.