If your theme is never going to be used outside of the Roots stack, I’m not sure why it matters whether ACF is a dependency of your theme or your site. If your site is going to be used outside of the scope of the Roots stack, you have a different problem to solve in terms of where your key will be stored so you can either distribute or reliably deploy the theme.
AFAIK you should be able to put a .env file in your theme root and then use ffraenz/private-composer-installer in your theme as you would in your site. Obviously you don’t want to commit that .env to your theme, so if you’re deploying w/ Trellis you could use use deploy-hooks/build-before.yml to generate a new .env in your theme folder, ala:
- name: Create theme .env
template:
src: "{{ playbook_dir }}/deploy-hooks/.env.j2"
dest: "{{ deploy_helper.new_release_path }}//web/app/themes/your-theme/.env"
mode: "0600"
Another approach would be to fork ffraenz/private-composer-installer and point it to your site .env. Changing this would probably do it: https://github.com/ffraenz/private-composer-installer/blob/296dae1d51e826978008962fd6ece1612c2eaeb7/src/PrivateComposerInstaller/Plugin.php#L36-L39 It seems a little weird to me to have your theme dependency dependant on the existance of something (the .env) in the site, though.