OpenBSD does implement some kind of privilege separation for X.

  $ ps ax -ouser,args | awk 'NR==1;/X.*:/'
  USER     COMMAND
  _x11     /usr/X11R6/bin/X :0 vt05 -auth /etc/X11/xenodm/authdir/authfiles/A:0-PFzcIG (Xorg)
  root     X: [priv] (Xorg)

Without claiming that X is secure: I think it’s more accurate to say that X has never cared about application isolation at all, since it wasn’t (like its contemporaries) built with that paradigm in mind.

In other words: while not originally UNIX-y, X matured in an ecosystem that idiomatically treats every userspace program as a perfect proxy for the user agent themselves. Sandboxing is a foreign (but good!) idiom that’s being bolted onto that paradigm.

I think you're phrasing that incorrectly. There was no application sandboxing for X to break. And you can't build sandboxing atop X.

You speak as if application sandboxing within the ever existed in the past... Not that people tried to build it and X doesn't play well with it.

I don't profess to have any deep knowledge of X11 or Wayland, but I don't understand how sandboxing can't work in X11. XWayland exists and it is either non-sandboxed (hence Wayland doesn't add any security benefit) or it is. And if it is it means that X can be sandboxed and it should be possible to run XonX sandboxes. Something like xnest.

This is a very good comment.

I guess then the claim is more that no common implementation is amenable to sandboxing, and the compatibility break of a brand new protocol means they can implement it from day 1 in the way they like. Which is a lot weaker an argument, but practically speaking, it's true that no one is rushing to bolt on security features to X. To be clear I'm not realy a Wayland fan.

You certainly can build sandboxing atop X11. If you're reading using a web browser on a Linux desktop (or in a VM on a Linux desktop), then you're literally staring at an existence proof.

I guess the point is it can't be sandboxed by directly exposing X protocol messages to the sandboxed app. Although your sibling comment by gpderetta makes an excellent point. I guess they're saying no one wants to sandbox the X protocol, and breaking compatibility, proponents would claim, lets you design a sandbox friendly protocol from scratch.