Where is that common behavior, is that GNOME's one, KDE' one, or the million tiny window managers' ones? Would you swear that no "application" developer would

Where is that common behavior, is that GNOME's one, KDE' one, or the million tiny window managers' ones? Would you swear that no "application" developer would want to log my keyboard if we include the transitive dependencies of every single nodejs/python/etc package that I use for regular-ass development? Because we have seen how trustworthy supply-chains are. But sure, you can definitely drive a car without a seatbelt on, it's just not a good idea.