SmartThings will look at one device at a time to get information based on the capabilities of that one device.
Another controller, like the security system, is a whole separate issue.
But in terms of each end device, if smartthings is able to talk to it, it likely does NOT reflect the three states you mention. Rather, a contact sensor is on or off. A motion sensor is active or inactive. A lux sensor reports a range of values. And so on.
If these end devices are certified zwave or zigbee devices, then their capabilities are defined in terms of those standards, and are self reported regardless of which controller queries them.
Some devices, like locks, may have more capabilities such as a tamper code, but each is still reporting based on the standard to which it is certified.
So as far as your 3 states: off, on-home, and on-away, that sounds more like a system state held by the controller of that system, not something that can be exposed at the individual device level. The motion sensor itself doesn’t know the difference, rather the controller handles the reports differently based on the system state. So that parallels modes.
Or did I misunderstand the kinds of devices that would expose the capability? For example, if SmartThings in fact does not talk directly with the end devices, but rather goes to the controller every time more like a web service, AND if that security system has zones, so that some sensors might be on-home while others are off, then it would make sense to give the types for the end devices the virtual capability of armed, but it would have to be reported by the security controller as the individual device likely doesn’t know its own state in that sense. All of the devices owned by the security system would be child devices to the security panel parent.