This is a very good comment. I guess then the claim is more that no common implementation is amenable to sandboxing, and the compatibility break of a brand new

This is a very good comment. I guess then the claim is more that no common implementation is amenable to sandboxing, and the compatibility break of a brand new protocol means they can implement it from day 1 in the way they like. Which is a lot weaker an argument, but practically speaking, it's true that no one is rushing to bolt on security features to X. To be clear I'm not realy a Wayland fan.