This differs from behaviour of importaddress where it works.
$ bitcoin-cli importaddress "<address>" "<label>" false
vs
$ bitcoin-cli importmulti '[{ "scriptPubKey": { "address": "<address>" }, "timestamp":0, "label": "<label>", "watchonly": true }]' '{ "rescan": false }'
error code: -13
error message:
Error: Please enter the wallet passphrase with walletpassphrase first.
Should maybe be fixed. The questions for me are:
a) Do users think the imported addresses/pubkeys-sscripts are encrypted when encrypting the wallet (they are not)?
b) should encouraging mixed wallets (watch-onlys & private keys) be avoided?
Yes, I wasn't sure is it a bug or feature of importmulti. In any case, importmulti and importaddress / importpubkey should behave the same way.
a) Do users think the imported addresses/pubkeys-sscripts are encrypted when encrypting the wallet (they are not)?
Why should they think so? You can view addresses, coins, tx history, generate new addresses without unlocking wallet.
b) should encouraging mixed wallets (watch-onlys & private keys) be avoided?
It's kinda simple now with multiwallet support. OTOH, I could imagine some people might want to see on the same screen their hot wallet balance together with watch-only cold storage, for example. Mixed wallet allows that. Kinda similar how some banks in Europe now allow to view account balance from your accounts in other banks in the Internet banking website. And I don't see any security risks or other problems this could cause.
Maybe EnsureWalletIsUnlocked should be deferred to the point it's needed?