The watch is already used on other parts of the MacOS (anything in System Preferences), I don't think that sudo is much different than allowing kernel extension to run, for example.