I have tested this with the latest betas. It does work, much like watch to unlock the Mac works. You really have to be close by too, about a foot or so.
It does however make the phone slightly less secure. If ANYONE* with a mask on comes to the phone and is right next to you, while you are wearing the watch, and they swipe up, it'll unlock. If you are awake (and notice the haptic feedback or unlock sound on your wrist) you can indeed instantly re-lock it. If you are asleep though... or not paying attention (like at a restaurant, whatever), and have your watch on, someone could easily come up next to you with a mask on, or simply pick up your phone off the table, and unlock the phone.
And it doesn't have to be a mask. While just covering your face with a hand doesn't seem to work, (or having no face there at all, or a full face) any pair of eyes with something (like a napkin) covering the nose and mouth does unlock the phone if you are within a foot and have this enabled.
You just have to remember if you are worried about scenarios like this to emergency lock the phone manually (holding down both volume button and the power button) once to disable faceID for that time period. Or put it in your pocket.
As with all security measures, there are tradeoffs. That's why they haven't defaulted this to on, and give you a quick way of disabling FaceID at any time (volume/power click)
NOTE: This unlock method does NOT work with apps that use Face/Touch ID API. Just tested that too. They still require a full authenticated face, or a passcode after a couple of failures. So someone isn't going to be able to unlock your phone and go into your bank, journal, authenticator, etc. protected by Face ID without your code or face no matter what. It just gets you through the front door.
(Also tested: if your watch is in sleep mode ... it won't unlock anything (phone, Mac) without first being taken out of sleep mode. Which means turning the crown, and then swiping up and shutting off sleep mode before trying to unlock the phone. All while not waking you up.)
* ANYONE is a presumption; I only tested it with my own covered face. I don't know if the phone is taking partial geometry of just the eyes.
EDIT: On reddit other people have tested this... it is indeed "a" face with a mask, not your face. So it is anyone.