Because Wayland is a display service protocol. It's not responsible for secure message passing between desktop applications: that's the DE's business. Just because DEs used X11 as an insecure inter-process message passing agent doesn't mean it's a good design or even make sense.