Windows' pointer position is available to even the most limited GUI application; it is not protected information. For win32 at least, I am not familiar enough to say that about the newer app packages which are much more locked down, but I would be surprised.
They queried that info based on a specific implementation of a framework. If that framework is implemented under Wayland, then through the Wayland APIs it will only get rudimentary info on mouse position (e.g. only when it’s in focus and the mouse is over it).
App doesn't have to be in focus. It receives pointer events over its own surfaces (plus in some additional cases like drags and grabs). It doesn't receive any information about pointer position otherwise, nor its global coordinates (at least not without extra protocols).
Is it possible that one could write essentially a transparent app, which is always in focus and just passes click events through the transparent layer?
You can write a transparent app, but its the compositor that decides whether it's in focus and your app will either pass both hovers and clicks to the window behind (not staying in focus for long and not getting any pointer events even when it still is), or it will consume them all.
Hopefully only if the given app has focus.
Why? I want to have some applications that can always see the mouse cursor like, xeyes. Because that allows me to implement a better customized desktop environment.
Then give that piece of code extra-special permissions. As I’ve said in another comment, the days where you downloaded your software from the sunsite or tsx11.ai.mit.edu FTP servers and could be confident that it and all its dependencies were trustworthy are unfortunately gone for a very long time.