How does a router know in which physical direction to send a packet in
order for a particular IP/MAC address to receive it?
The transmitter doesn't "know" which direction to send. Radio waves, like light, radiate in all directions from the source. Directional antennas can focus energy in a particular direction somewhat, but it's not absolute. In addition, like light, radio can reflect off of surfaces.
That said, newer APs (802.1n or ac) use beam focusing that concentrates energy towards the last known direction of the wireless client. Again, it's a general direction, so there's a lot of energy going other directions as well.
Is the data sent out or scattered in a random direction, and all
devices on a network listen to all network traffic and act only on
those matching its IP/MAC address?
Not random, but all directions (think of a lightbulb). Clients listen for their MAC address.
Does this not raise security vulnerabilities? And is the same is true
of wired networks?
Yes, which is why Wi-Fi is usually encrypted. Only the stations that have the correct key can decrypt the data.
Wired networks have similar concerns, but since they require physical access to the network, it's less of a problem. 802.1x and 802.1ae were developed to address those concerns.