You'll notice a couple of things happened with that command.

1. Pathauto was installed, along with it's dependencies "Ctools" and "Token". This is one great thing about Composer. It is a dependency manager, so it installs all of the dependencies of the package you requested. But, it goes even further, and installs the dependencies of dependencies - recursively - until you have everything you need to use the package you originally requested.
2. It also installed the dev version of Pathauto instead of the "recommended" version: 1.0-beta1.

And if we take a look in our composer.json file, we'll see that Pathauto was added like