X has no provision for untrusted programs running with access to the X server. That design is naive by modern standards, but whether that's a "flaw" is a matter of interpretation. It would be nice if there were a model for running individual applications as application specific users or subusers, but Wayland doesn't solve that problem, either.

X being 40 years old has nothing to do with when it's reasonable to break compatibility. The amount of time that a suitable replacement has been around does matter; Typical times are 2-5 years from a suitable replacement being available to deprecation, which is to say that we'll be able to deprecate X in 2040 when someone's built something that actually solves user needs, unlike Wayland.