Sri Lanka found themselves 93 for 7 when Vandersay joined Tharanga at the crease as the Pakistan attack made short work of the Sri Lankan top order.
Recently, the ICC World XI toured Pakistan for three T20Is and this led to the PCB announcing the Sri Lanka match as well as three T20Is against two-time World T20 champions West Indies.
After paceman Junaid Khan removed Niroshan Dickwella for three in the third over, spinners Shadab, Shoaib Malik (1/17) and Mohammad Hafeez (1/24) rocked the Sri Lankan batting with regular wickets.
Pakistan skipper Sarfraz Ahmed believes Sri Lanka have nothing to worry about if they visit Lahore for the third T20I.
Though the players, all of whom have been awarded the central contract by their cricket board, did not explicitly refuse to tour Pakistan, they requested a change of venue due to security concerns. Malik and Babar added 31 and it looked like they would bat on like they had in the first match, but Malik too played a cut early and was caught behind.
Tharanga admitted it was the side's batting that let them down.
Azam followed up his 103 which anchored Pakistan's 83-run win in the first game in Dubai on Friday by once again anchoring the innings, bringing up his seventh one-day hundred off 130 balls - his fourth this.
Pakistan scored 292 runs for 6 in 50 overs in which Babar Azam scored a ton.
Shadab, who scored 14 not out in his only previous innings, played a support role during which he hit just one boundary off 68 balls.
The players have said they remain uncomfortable about travelling to Lahore for the last match of the ongoing series between the two countries in the UAE.
Leading cricket nations have shunned playing in Pakistan since the 2009 assault, in which gunmen ambushed the Sri Lankan team bus en route to the Lahore stadium, wounding at least seven players.