How to catch "Thing 'zwave:device:xxx:node3' has been updated." in rule

Just for comment, professional alarm sensors can be had which can detect attempts to tamper (mask) like this. Magnetic devices can have a second tamper reed contact or hall sensor activated by unexpected mag fields. The magic of microprocessors allows many PIR to spot masking attempts.
I keep telling people that Alarm designers think of things that they haven’t :wink: