Yup, this sounds about right.
It is only @rescript/runtime code that will end up in your bundle so it does make sense to add that to “dependencies” and the compiler to “devDependencies”.
This does highlight a DX problem, I suppose.
Your need two packages in practice and those can conflict. Similar to how you can mix react 18 with react-dom 19. You want those in sync, a mismatch can lead to headaches.
This problem only really surfaces more clearly when you are using isolated installs.