sorry, i'm not a hacker, so i dont know any attach vector. :( But it does not mean that it does not exist.

Well - making all IPv6 stuff a noop is not coded into VyOS. Can you show real life examples of increased attack surface?

it's enabled by default.

It's useful when the user is sure he doesn't want IPv6, as it lessens the attack surface, especially if the user doesn't know he needs to configure a IPv6 firewall separately to the IPv4 firewall. Even link-local addresses can be used to launch attacks in the absence of a firewall config.
IMO the configured interface addresses and v6 nodes should become no-ops, possibly print a warning on commit.
On the other hand, leaving IPv6 enabled, would be better to move in the direction of v6 adoption. Personally, I'd prefer this, and leave v6 enabled by default.

in my opinion it should be always enabled

Actually why do you wan't to disbale IPv6 on the system? I think this is a huge workpackage.

https://github.com/vyos/vyos-1x/pull/263
https://github.com/vyos/vyatta-cfg-system/pull/121