Nimble-fingered crooks can exploit the one-second lag before Watch senses it's off a wrist and asks for a passcode.