Only programs running as you can access your X server. If a program running as you is malicious, it can steal all of your data and do whatever else you can do, without needing to involve your display server. The only thing Wayland's "security" actually prohibits is legitimate programs like xrdp.
RDP is functionality that has to be built into the compositor, rather than a pretty integral part of X itself. WSLg (Windows Subsystem for Linux [2] GUI) works via RDP, and it's Wayland only too.
> RDP is functionality that has to be built into the compositor, rather than a pretty integral part of X itself.
But that's not a good thing. Code should be able to be written once and reused, not rewritten for every single compositor, which in practice means every single DE and then some.