I'm not trying to claim that X is secure as is. The claim I'm making is: 1. There is nothing fundamentally insecure about the design of X that couldn't be fix

I'm not trying to claim that X is secure as is. The claim I'm making is: 1. There is nothing fundamentally insecure about the design of X that couldn't be fixed with a bit of effort. 2. The effort required would be significantly less than what has gone into Wayland over the last 16 years. Fixing the security of the system certainly would involve changes to more than just xorg. Anywhere there is a security boundary you'd need to make modifications - but that's OK, most of these security boundaries are younger than wayland anyway. This discussion of $DISPLAY seems like distracting minutiae. Sure it's a medium size problem that would need solving, but that's all it is. To address your specific point: it could be the responsibility of the window manager to set $DISPLAY to a less powerful socket when starting processes. Ultimately it doesn't matter though, because if the display server isn't doing some sort of sandboxing then the spawned process can just ptrace xorg and do whatever it wants. X being secure only matters in the presence of a security boundary and in that case it would be the responsibility of whatever is setting up that boundary to create a less privileged socket. Whether that be ssh or flatpak or whatever.