If a Core user has been assigned the Time & Expense subscription package along with the Time & Expense security profile, how does Employee Control apply to this?
The Core user's subscription package determines which modules and features they have access to in Core. Check the Help Guide for details. So in this case, the user can access the time and expense related screens only. Then the security profile also controls the access to features and functions, but within the subscription package of the user. Subscription and security go hand in hand, so no feature is available if only one of them permits it. In other words, if a user has Full Access security, but is subscribed to Time & Expense only, the user won't be able to access anything outside the time and expense modules, even though other screens are visible. Check the Help Guide for details.
On the other hand, Employee Control is a security feature, but it does not add or remove any modules from the user's access. It works in conjunction with the user's security profile to control access to projects, activity and expense items in various screens. In other words, it controls which projects, activity and expense items are visible to the user in various permitted modules. Check the Help Guide for details.
If you apply Employee Control for a user on a module that the user's subscription package or security permissions does not include, it will have no bearing on the user's access as that module isn't visible in the first place. It will only have an effect if you apply it on a module that the user has access to.