_NET_WM_PID is optional, some clients do not set it and even then afaik the server doesn't do any sanity check and the client can set it to anything, making it inherently insecure. This is not good design.

> What makes you think this is the case? Many other ways in which async behavior happens on X11, on any machine I've tried, with the mouse cursor lagging to register a click event, for example.