Only the "ShooterImage" component relies on Xorg (the other components work regardless of window system). Note that the reason Wayland isn't affected is because

Only the "ShooterImage" component relies on Xorg (the other components work regardless of window system). Note that the reason Wayland isn't affected is because the malware doesn't use the API needed for taking screenshots.