That components vendor of course then has to make the source of the LGPL dependency available on request. But what about me?
What would I need to do if I wanted to sell a closed source product that uses this MIT licensed component which is of course totally permitted my the MIT license. Would I have to stop using this MIT licensed component unless I also want to provide the source code of a dependency lib that I might not even be aware of?
If, on the other hand, the MIT licensed product doesn't mention the dependency, and you cannot be expected to have learnt of it elsewhere, you should be of the hook, both ethically and as far as damage lawsuits go. As soon as that "expected to know of" changes, you must change your license and provide the source on request (or remove the dependency or stop shipping your entire product)
Of course, that is an opinion and just theoretical. In practice, who knows what will happen? That is one reason large companies are/used to be worried about using any source that doesn't ship with extensive disclaimers. Large companies are expected to spend more effort researching these things. That lowers the threshold for "should have known". They generally also have more money. That makes them more open for lawsuits if they are found to walk in a gray area.
Nothing that dynamically links with it. Static linking makes your code part of the library and requires source.