I had the same experience as you with Jekyll plugins that are declared as dependencies in the theme’s gempsec… had to add them to the Gemfile and plugins array in _config.yml manually.
Probably won’t be an issue if/when the Jekyll remote theme plugin is supported on GitHub Pages since that gem will pull in dependencies like Jekyll-seo-tag, sitemap, feed, paginate, etc.
I guess the only issue would be for theme gems using non-whitelisted gems in non-GitHub Pages environments.