You can do this:

def aliases do
  [
    testtask: [
      "deps.get",
      "deps.compile",
      # Compilation prunes code paths, so Hex task modules are no
      # longer available. We need to bring the application back
      # explicitly, in order to access its modules.
      fn _ -> Mix.ensure_application!(:hex) end,
      "hex.audit"
    ]
  ]
end

So I traced it down to the fact that after running any non-hex task Code.ensure_loaded(Mix.Tasks.Hex.Audit) returns {:error, :nofile}. But if no other non-hex task was run before, it returns {:module, Mix.Tasks.Hex.Info}. Unfortunately I don’t know why is that, but maybe someone more knowledgeable would have some idea.

Okay, so apparently my example wasn’t specific enough.
Upon further examination, the hex mix task has to be at least the third in line in the list. The list can have more than three items in it as long as the hex mix task is number one or two. So for example this works:

defp aliases do
    [
      testtask: ["deps.get", "hex.audit", "deps.compile"]
    ]
end

But this does not:

defp aliases do
    [
      testtask: ["deps.get", "deps.compile", "hex.audit"]
    ]
end

It results in:

** (Mix) The task "hex.audit" could not be found. Did you mean "deps.audit"?