Wayland security is a side effect of how the core protocol works. In X, you have one giant buffer, while in Wayland, each application renders to its own buffer and pushes that buffer to the compositor when ready.
X has had compositing for ages as well. That didn't require preventing applications from moving the cursor or simulating keyboard input and even screen grabs still work fine.
I'm aware, I've been there since Xgl when Kristian Høgsberg worked on AIGLX. Wayland makes the current X model the default, it is X.