A business unit wants a group of users to only have access to one specific doc
library as read only. The site owners do not want this group of users to see
anything else on the site but the one library. However, they need these users to
have alerts.

I've noticed that if the users do not have read-only permissions on the
containing site (a subsite in this case), they can't set an alert. They get the
"access denied" error when they try.

I've never noticed this before - is this known behavior?

I suppose the workaround is to create a sub-sub site, perhaps a document
workspace, to do this, but it's more hassle for my end users than I like.