Someone who has a malicious npm package running on his machine has bigger problems. It will already be able to read/write every file that the user can. Why is the screen so special that we need to break everything?

I see so many screencast/input-sharing/macro apps on github that have been in a holding pattern--for years!--waiting on wayland to either fix a bug or add a feature. 14 years of wayland so far, and we still can't do things that every other major OS's display server handles easily. At this rate, wayland will certainly become exploit-free, since no one will be using it.