Where should bower_components reside under Drupal 8
It's both. One of the main issues with civicrm+drupal8 is that drupal 8 (correctly) doesn't allow web access to files in the vendor folder, since that can be a security issue. Both roundearth and civicrm-asset-plugin try to deal with it, just a bit differently, by copying the files to a web-accessible folder, via composer events that are triggered when you run composer.

It doesn't copy all files, just the ones needed. It is possible for them to get out of sync if for whatever reason the composer event doesn't trigger, but you can re-sync by deleting the one under /web/libraries and running composer install again. You may need to delete one the /vendor bower_components subfolders to get that to trigger it. I never know what composer is really looking at when it decides what to do.

UPDATE: If you're using the civicrm/civicrm-asset-plugin (as opposed to roundearth), running composer civicrm:publish from the top folder (above vendor) will re-sync the appropriate files from vendor to web. For roundearth, I haven't tested this but it might work to use composer civicrm:sync-web-assets, also from the top folder.