They only way to implement this securely is if the stuff is self hosted. You setup a device in your home that can open up a port via uPNP, the watch connects directly to the device using a shared set of keys that never goes to a central server, and all the code on the watch and home server are open source and they are setup by default for regular, automatic, signed updates.

There can still be security issues in this situation, but if enough people use it and hack on it, they have a better chance of getting fixed quickly.

The trouble is, this type of setup is a nightmare to implement. Home routers today still make this incredibly difficult. Most people would just get frustrated and prefer something that has a central server, with closed source garbage, that seems to do everything for you.

Plus there's more money to be made if you can collect all that customer data.