Well I'll be damned, so you can. With a watch alone they'd have limited access, but if you steal somebody's watch without the watch realising it's been removed & also steal their phone you can almost certainly unlock the phone with the watch (my partner + I use that all the time when driving... they pick up my phone, show it only their eyes, and the phone assumes it must be me wearing a mask and so it uses my unlocked watch on my wrist to unlock the phone).
The good news, however, is that you don't appear to be able to use the Apple Watch mask unlock feature to pass further Face ID checks deeper in the system once unlocked, so your banking apps & password manager is safe... but your messages & e-mails are not...
The good news, however, is that you don't appear to be able to use the Apple Watch mask unlock feature to pass further Face ID checks deeper in the system once unlocked, so your banking apps & password manager is safe... but your messages & e-mails are not...