> it requires the watch being connected to a compromised AP

Nope. It simply requires that you are able to talk to the watch. So any device on the LAN should do. That's a disturbingly low bar for a wearable.