It's probably a tooling issue, though: the LSP should tell you if you miss reactivity, as it does in the script tag with state_referenced_locally.
It successfully throws it as soon as you introduce a $state or $derived and depend on it in another {let ...}, but not with external data sources.