Yeah a secure-by-default system "doesn't treat you like an adult."

it's where the security boundary is. The system should protect me from unwanted software getting on the system. Once a piece of software starts running, I do want to give it full access to the system. If not, I'll run it in a container. All the protections wayland offers are to protect against a piece of software someone had to already have access to install. If you are that paranoid, set up selinux properly. Which nobody does, cos it's a pita. Enforcing permissions for everything on everyone is a similar pain in the ass.