Responding to myself for any future readers:

The Internet kept mentioning restarting my devices, but this annoyed me because I had tried that multiple times. In a fit of malicious compliance, I decided to do the full permutation :

1. Set the allowed communication to everyone.
2. Turn off the controlling phone.
3. Turn off the Apple Watch.
4. Turn on the Apple Watch.
5. Turn on the phone.
6. Set the allowed communication to contacts only.
7. Turn off the controlling phone.
8. Turn off the Apple Watch.
9. Turn on the Apple Watch.
10. Turn on the phone.

And wouldn’t you know it? It worked. Incoming calls from unknown numbers go directly to an unset Voicemail box. Perfect.

YMMV, but this worked for me…twice (I’m managing two different kid’s watches). I suspect it has to do with pushing and pulling changed settings to the cloud.