back when Apple has proper smartcard/CAC support, there used to be an option "Turn on screen saver when login token is removed"