Two different questions. You're talking about whether the app must get the user's approval. The question here (in this part of the thread) is whether the app must subscribe to all events and filter them itself or if it can instead subscribe to a filtered version of events.
I know that an Xapp can listen to everything, but I was thinking that it can listen to only some keys/combos.
How would you write an application that uses global shortcuts in Wayland?
Probably through a series of incompatible and as-yet-unimplemented APIs for each desktop environment and window manager you want to support.
You wouldn't, because Wayland is not ready for consumption by people that use their computer with expectations of full functionality. The obvious things for most people (shortcuts being one of them) do not yet work in it.