You're right, you need to inject it yourself.
\Phalcon\Mvc\User\Component implements both \Phalcon\Di\InjectionAwareInterface and \Phalcon\Events\EventsAwareInterface. The first provides you with setDI($di) and the second with setEventsManager(\Phalcon\Events\ManagerInterface $eventsManager), so you can set them and use them accordingly, but no they're not provided by default.