"It just doesn't do it for dependencies of your dependencies"

Yes, it does. cabal-dev can install a fully hermetic package database if you ask it to, but by default it only installs packages that aren't already present in your global package db.