I think there are two gaps with the watermark:

- it only gives a high probability that the text was outputted from the model, whereas a crytographic proof is computationally infeasible to forge

- it cannot be traced back to the input. You could "wash" the output from one model into another and it would be watermarked by the latter. With the crytographic proof, if you have the input, output, and "commitment", you can verify your exact input was processed by the model (or so the model provider says).