It is expected that for a module which adds a dependency to .info.yml it must be enabled in an update hook, rather than Config Distro reading .info.yml and enabling modules with its config updates?

We also run into this issue constantly... You would think Drupal Core would read info files and enable any modules added to the info file of a module as dependencies.

On its face it sounds like any easy issue to solve, but what if the module doesn't exist in the codebase until composer update is run, or isn't even in composer.json at all.

The fact that we have literally three dependency management systems to contend with here is fairly daunting.

At the very least we could add a section to the readme that includes some instructions for adding new module dependencies.

For example in you module's my_module.install file

/**
 * Ensure module dependencies are installed .
 */
function my_module_update_1020801() {
  $array_of_dependencies = [
    'module_1',
    'module_2',
  ];  
  \Drupal::service('module_installer')->install($array_of_dependencies);
}

In your module's my_module.info.yml file, add modules to the dependecies array

name: My Module
type: module
description: 'Example module description'
core_version_requirement: ^9 || ^10
package: 'Custom Modules'

php: 8.1

dependencies:
  - module_1:module_1
  - module_2:module_2