I tried this in an example of my own and you are right: It is not possible to use composite components in sub directories by default. As Leonardo pointed out in a comment to the question, this is not allowed in the JSF spec.
In MyFaces, however, this behavior can be changed by setting the context parameter org.apache.myfaces.STRICT_JSF_2_ALLOW_SLASH_LIBRARY_NAME
to true
.
With this parameter set, I can use composite components in sub directories with MyFaces 2.2.0.