Strictly speaking, that round metal mounting bracket on the back of the fixture is supposed to be secured to an electrical box.
It can be a shallow box, but it's supposed to be a box. You must protect the wires. You want that new garage to still be there 10 years from now.
I can't really tell from the photo, but the right shallow metal box should fit within that recess on the back of the fixture without you needing to cut a hole in the siding. But if you have to cut a hole, then you have to cut a hole (if you do, rent, borrow or buy a holesaw for your drill big enough for the box).
You could attach the box through to the OSB with screws, although personally, I'd lay a 2x4 flat side against the OSB inside the garage, toenail it into the studs on both sides, and screw the box directly through the OSB into that 2x4. So a stiff breeze or errant basketball doesn't knock your light fixture off the wall. :-)
Drill a hole through the OSB and the 2x4 big enough to feed the cable and to accommodate the clamp that holds the cable in the box. The cable has to be clamped into the box.
Then attach the round mounting bracket that came with the fixture to that box, wire everything up, attach the light fixture to the bracket that you attached to the box. That's the way it's designed.
If it's a metal box, it has to be grounded (screwing the grounded mounting bracket to it will accomplish this).
You also have to secure the cable inside the garage as dictated by your local electrical code.
Finally, I'd use a dose of waterproof silicone or caulk around the box, and then again around the fixture itself after it's mounted, to make sure water doesn't seep inside.
Good luck!
You said:
So in that case I really don't understand how this method would prevent moisture, which may have already gotten behind the vinyl, from getting into the electrical box.
You are correct in your assessment, the siding is not waterproof or even moisture proof. Water will get behind the siding, hence the reason for underlayment or house wrap. Electrical boxes cut into siding will not be waterproof or moisture proof either.
The code just requires you to use a weather resistant / tamper resistant receptacle and an in use cover if it will be exposed to the weather. If it is under a porch or patio you can use a old style spring cover like a Bell box cover.
The terminals and connections in this box will probably corrode and need replacing before anything inside the house but should last for 10 years or so depending on your location and the weather.
If you want it as water/moisture proof as possible then install an all plastic solid device box with PVC nipple attached with a PVC connector to a junction box inside of the house. Then wire it with THHN/THWN wire instead of NM cable. Then use an in-use cover with a gasket and the aforementioned weather resistant / tamper resistant receptacle. That should keep the inside of the box pretty dry.
Good Luck!
Happy Thursday!
Best Answer
I realize this is a little late, but for those reading this for answers:
Make a 4” round hole in the center. The existing hole in the siding box is around 1-1/8”, so if you have a 1-1/8” hole saw, Nest it in the 4” to stabilize. If you want to save money and not buy a hole saw, trace your octagon box (keep reading) and use tin snips to cut out the hole.
Get yourself an octagon box that has a depth close to, but less than the depth of the siding box. Install an NM clamp (plastic or metal, plastic will work better). Space the box off the back of the box so it is flush to the front, screw it down, and install the light.
Tip: Screws can be your spacer. Make a triangle out of three screws that prevent the box from setting too far back. The secure the box with 2 screws.