What if we instead added wp-cli/wp-config-transformer as a wp-cli/wp-cli dependency and had wp-make-coffee handle it?

And, taking a step back, why is this necessary? Shouldn't Composer install the latest automatically?

What if we instead added wp-cli/wp-config-transformer as a wp-cli/wp-cli dependency and had wp-make-coffee handle it?

No, I currently try to get away from having the framework depend on command requirements, as we have now with the Symfony dependencies that are actually only needed for the package manager. Related: wp-cli/wp-cli#4748

And, taking a step back, why is this necessary? Shouldn't Composer install the latest automatically?

It is not necessary for our Phar build, but it could avoid bugs for Composer builds where a hard requirement on the bug-fixed version shows errors when you try to use an older one.