LLM-based Vulnerable Code Augmentation: Generate or Refactor?