In my opinion, Wayland has avoided this by deliberately being simpler than X11.
> I'm using $DISTRO because I trust them enough to not package spyware/malware in their repos
>but holy hell my OSS desktop is not a proprietary smartphone OS loaded with random closed-source apps from god knows who that tries to steal my data for profit
I think it is not reasonable for you to ask them to never plan for a day when that could happen, if that is what you are suggesting anyway.
>You'd assume there's an equivalent tool for Wayland
Not if you were aware of the current issues with Xrandr and why it is a poor target.
>But mumble mumble security, you cannot do that, so we got the same f#+ing situation as with screen recording again, every WM/compositor comes up with their own solution to something absolutely trivial. GNOME/Mutter have a dbus-API, wlroots-based ones have "wlrandr" via some protocol extension, KWIN I didn't even bother checking. But it's only 15 years since the project started right, why should something trivial as this have been settled upon yet?
It is absolutely not trivial, and there are security/usability issues with it. To do this "the right way" would be more or less duplicating the entire KMS API into every implementation. Even XRandr is still missing features compared to that, so it is not an adequate solution either.