If you do check X's codebase though, you'll notice it's very well written and completely maintainable.
As an example, people often say you can fake input on X and therefore it's insecure, but fake input on X (XTEST) sets a boolean send_event that the receiving application can check to see if the event was sent from another application. Most apps ignore that, but Wine drops any event marked as send_event. I do not like this solution. Instead, inter-process access control lists could solve this easily and would not be hard to implement. Yet, some people think throwing 30 years of solid codebase down the toilet and pushing an inferior product is a better solution. Those people have no idea about X programming or its internals and are just echoing a mantra.