@redsakana@infosec.exchange @ids1024@mathstodon.xyz @ariadne@social.treehouse.systems @cb@social.treehouse.systems For general desktop (or worse, phone) use case where you're running binary packages shipped by VC-funded parties, it's absolutely a serious concern. But you address the concern not by breaking standards and breaking things people want to do with the distro-shipped free software they trust, but by using the existing mechanisms that already let you separate things into access control domains, to give untrusted or known-malicious apps only limited-scope access where they can't see and interfere with your other X clients.