YouTube blogger macgeek discovered that Apple Pay Suica works on his Apple Watch Series 2 device even with the device locked and off his wrist. As explained in his video, this is the way Apple Pay Suica is supposed to work when Express Transit is turned on, but what about security?
Express Transit only works with the Stored Fare (SF) on Suica and debits the SF amount. Once SF is used up you have to recharge Suica using an Apple Pay credit card which requires TouchID authorization. If your iPhone or Apple Watch are stolen the thieves could use the SF amount of your Suica but could not use Apple Pay to recharge Suica or make purchases.
The only potential fly in the ointment would be if you have Suica SF auto-recharge enabled in the JR East Suica app. JR East limits daily SF auto-recharge to a 20,000 JPY maximum. In any case the solution is simple: if your iOS device is lost or stolen the first step is to turn on Lost Mode which disables Apple Pay.