If you run a process you entrust it with everything that your uid has access to. If you run X, any process gets access to your input. Those aren't security bugs

If you run a process you entrust it with everything that your uid has access to. If you run X, any process gets access to your input. Those aren't security bugs, it's the design, the Qubes design allows you to isolate apps you mistrust (like the browser).