The problem is ordering. $srcDir is being set correctly, but when it’s set the call to wp_localize_script has already happened.
Instead, consider changing your code to refer to a data attribute in the content that the shortcode returns. This also prevents the code being tied to only allowing a single instance per page.
Additionally, there is a major security issue. By passing in the folder name, you open the site up to directory traversal attacks. Users could craft their own values that include ..\ to look anywhere in the filesystem and retrieve any file they wanted, including wp-config.php. They could then use that information to connect to your database and make steal information or insert their own information, e.g. “You’ve been hacked send 10,000 bitcoin to xxxxx”
Additionally, your functions and global variables are very generic, and in no way prefixed, so if another plugin used srcDir it would clash, breaking things.
I would also recommend abandoning the Admin AJAX route in favour of the easier to implement and more secure WP REST API
Have you considered using a custom post type with files attached? The same way WordPress creates posts of type attachment for uploaded files? You could have attachment files with a parent post of type document set. This would allow you to eliminate the need for an AJAX endpoint or a REST API endpoint entirely, letting you use the ones that come out of the box with WordPress at /wp-json/wp/v2/etc..