This happened twice in the past several months, an email based (in this case re: Tolls that’s been widely reported) sms appearing on the watch but not other iOS devices, unknown senders allowed on phone and iPad for the reasons you stated but neither received the message.
In the many years checking Apple Forums for solutions to issues that affect countless customers (keeping in mind the total amount spent per person is higher than any other consumer technology company) I’ve never seen any solutions here (or elsewhere typically), such is the black box of our beloved ecosystem. The really important (bad) stuff does seem to have priority for fixing however, leaving annoyances to persist with no official acknowledgement.
My 2 cents is that since the watch is perhaps their most device agnostic device (Android users must receive message notifications too) vs the iPhone, it allows email to phone number (indeed isn’t set up to independently block messages) readily. The iCloud sender address may be spoofed to make the message seem more legitimate (mine used Hotmail, a possible clue!) but that doesn’t mean they’ve sent it to your ApppleID email. Most likely they’ve used the US carriers’ free “email to sms” services to mass send messages to our billions of breached phone numbers from their computers (robo copy/paste!).
ATT will decommission their email to text service next month, while Verizon and T Mobile still offer it; Verizon does offer you to opt out of this “feature” https://www.verizon.com/about/account-security/email-to-text-faqs. It’s a now anachronistic legacy (ie pre smartphone/iPhone era) service from when everyone didn’t have a mobile phone and SMS (unlike email) wasn’t essentially free.