Is it still the case that a user cannot grant HealthKit access on the watch alone even though Watch Series 3 now can be completely untethered via LTE?
Yes, the user must still grant HealthKit access to WatchKit apps on watchOS 4 using the phone.