If you look at the implementation of AuditReaderFactory
(here), a new instance of an AuditReaderImpl
is created on each call; the instances are not cached anywhere themselves.
It isn't also specified anywhere that you should get the same instance given the same session; so your request can be treated as a "feature request", but I wouldn't say it's a bug.
There's no specific reason not to reuse same audit reader instances.