In fact I remember reading about the apple pay system requiring the security code if the watch was taken off. Clearly sensors exist to detect when the step is connected or not.
At the same time, the idea of third party control and expansions sounds very likely.