Every sensor is unique. That's why they are screened for hot/dead/stuck pixels at the factory and pixel mapping is done to each one before they're sent to the marketplace to be sold. With the millions of photosites on modern sensors, the probability that two sensors, even from the same batch, have the exact same mapping is pretty much statistically impossible. It's every bit as unique as a fingerprint.

If someone has the specific camera in question in their possession, they can fairly easily verify if a photo taken with that specific model camera came from that specific copy or not. No "watermark" needed. It's already there in the raw data off the sensor. That's assuming the image in question is reasonably exposed so that it's not completely blown out with every single pixel fully saturated, in which case the raw data contains no real usable information of any kind.

It's also possible to verify or eliminate if two disparate images came from the same camera or not. This is a bit more dependent upon the scene contents and exposure levels of each image, but it's still possible to compare two images and determine whether they were taken by the same specific camera or not with a fairly high degree of certainty.