It appears that Skyrim uses areas designated as "Encounter Zones" to spawn random events and NPCs.
Encounter Zones: the quick explanation
In-game geographic regions that "listen" for the player character's presence. On entering an encounter zone, an event may occur. Events can have in-game time ranges where they can occur and perhaps other conditions (such as quest completion or random number generation). Encounter zones may have multiple possible events, allowing them to randomly spawn any of a set of events. Events are usually NPCs spawning with preset behaviors, or random hostile monsters/bandit spawns.
According to the Unofficial Elder Scrolls Pages (UESP) wiki, vampire attacks in a city can only happen 9 PM to 5 AM. Does this mean that it's possible to avoid vampire attacks in a city completely by going indoors (in town) at 8 PM, then waiting or sleeping until 6 AM before exiting your chosen vampire apocalypse shelter? Vampire attacks always seem to happen on arriving in a city, which means their encounter zones would be right on the city gates. I have yet to find one of those encounter zones indoors.
Another guess: Are vampire attacks impossible in Solstheim (Dragonborn expansion)? I have yet to see a town or city get a vampire attack in Solstheim - presumably it would be impossible to build the Dawnguard-specific vampire attack encounter zones into Solstheim because that would make Dragonborn dependent on Dawnguard (screwing up Dragonborn for people who lack Dawnguard).