Q1: It seems that this library produces a proper CMake config, so those variables aren’t needed and thus aren’t set, as the library’s target is discovered in CONFIG mode.
Q2 and Q3: Already answered by Eric here.
I would only add that if you, as the maintainer of YOUR_LIBRARY, know for sure that consuming projects will use some of its dependencies, then you might want to use the PUBLIC scope on linking to those dependencies (and also consider adding the corresponding find_dependency() to your library’s CMake config, which in most cases you should do anyway, no matter the linking scope).