It's worth trying to understand the qubes security model a bit because it's very different from a normal distro. Essentially dom0 runs the xen hypervisor and then all your "actual work" gets run in various sandboxed vms which are highly protected. Normal vms have the system directories wipe and reset on reboot and there are also transient "tempvms" that literally get completely burned down and have no sideeffects. You can lock down which hardware is accessible from which vms as well as very finegrained control of things like network traffic (including ingress and egress). Clipboard is not shared between vms (although there are ways to explicitly choose to do crossvm cut and paste) and other copying or sharing between vms is also very tightly controlled.

In that context, security vulnerabilities in X11 don't have the same impact as they would in a normal distro. User processes running in a VM don't have the ability to exploit a problem in X11.

Go here https://www.qubes-os.org/faq/ and scroll down to "How does Qubes OS provide security?" to understand better.