Not a very nice thing to do anyhow. Guess it doesn't matter too much for this project but not marking development dependencies as such is horrible for any consumers of the module.
Thimble itself is an end-product, not a module. The only way to work with it outside of our deployment infrastructure is to run it with all the dependencies installed and brackets installed on the side. We're thinking of just dockerizing it, but there is no "casual install" for Thimble right now.