Maybe it is fine to use "deps += $(ro-deps) $(rw-deps)" ?

Yes "+=" is probably ok here.

While you are fixing this we might want an additional detail:
the quoted "deps +=" is protected by a giant "ifeq 
 $(CONFIG_USB_POWER_DELIVERY),y)", but we might want to use the same condition as for everything else:
e.g.
deps := $(ro-deps) $(rw-deps) $(deps-y)
with the additional dependency declared like this to depend on the config option:
deps-$(CONFIG_USB_POWER_DELIVERY) += $(out)/util/usb_pd_policy.o.d

The following revision refers to this bug:
  https://chromium.googlesource.com/chromiumos/platform/ec/+/653a18ffc412403963f6bc4b705c256062bf2f72

commit 653a18ffc412403963f6bc4b705c256062bf2f72
Author: Che-yu Wu <cheyuw@google.com>
Date: Tue Sep 05 15:21:27 2017

ec: Fix missing Makefile dependencies.

Add the extra dependencies to "deps-y" and include it in "deps".

BUG= chromium:761922 
BRANCH=none
TEST=Add "$(info $(deps))" before "-include $(deps)" in Makefile.rules
     make BOARD=eve utils | grep "build/eve/util/usb_pd_policy.o.d"
     There is "build/eve/util/usb_pd_policy.o.d"

Change-Id: I77670a8e90a1a913943fcba143402318aaf7d274
Signed-off-by: Che-yu Wu <cheyuw@google.com>
Reviewed-on: https://chromium-review.googlesource.com/649455
Reviewed-by: Vincent Palatin <vpalatin@chromium.org>

[modify] https://crrev.com/653a18ffc412403963f6bc4b705c256062bf2f72/util/build.mk
[modify] https://crrev.com/653a18ffc412403963f6bc4b705c256062bf2f72/Makefile