Found another problem - I didn't add SDL_LIBRARY_ONLY to the list of required variables in FIND_PACKAGE_HANDLE_STANDARD_ARGS, so that is probably why it was reporting SDL2_FOUND despite SDL_LIBRARY_ONLY being unset.