The files for find_package(dep) when using ExternalProject_add(dep) won’t exist until build time. So you cannot use find_package(dep) to load your dependency.
There are techniques for actual development. Look for DEVELOPER_MODE in our common-superbuild. What this does is build all of the dependencies of the specific project and provides a developer-mode.cmake script that can be used to pass as -C developer-mode.cmake to configure an arbitrary build tree as if it were in the superbuild (namely finding dependencies).
Yes. Vendoring without offering controls to “unvendor” is a wonderful way to make packagers’ lives hell because somebody else is going to want that dep someday too. If a superbuild is not suitable, it might be that you can document a list of Conan or vcpkg packages that are needed and use those environments to provide dependencies.