Heh, just noticed your username, obviously you know what you're talking about.

I also misinterpreted what this issue was about; my mental assumption of "pastejacking" is when a malicious app grabs the (possibly sensitive) clipboard contents without the user knowing about it (which the Wayland protocol doesn't protect against via a serial number in the request)... but that's the opposite of this issue. And you're right, in this case a compositor could absolutely reject Firefox's set_selection() request here since any serial passed to it would probably be out of date.

And correct me if I'm wrong, but IIRC wlroots does make an effort to check that the serial passed is current enough.