FWIW the Xorg already has the functionality to isolate clients from each other, but it is underdocumented and not that easy to set up - see xauth as a starting point.
The limitations that are there are very minor and if someone cared they could be completely eliminated. As you wrote, Xorg is opensource - which also means that these limitations exist since there wasn't much of an interest towards addressing them.
Though there is also the bureaucracy aspect - in recent years i've been trying to provide fixes, improvements, etc on various open source projects i'm using and i've noticed that the more involvement there is by companies in a project, especially among maintainers, the more bureaucracy and harder it is to get things merged to the point where whenever i see an issue with something that has at least one bigger company behind it, my first instinct is to make my own fork, fix it there and leave it at that. Or not bother. Projects that are primarily run by volunteers tend to be way easier to get involved with.
The limitations that are there are very minor and if someone cared they could be completely eliminated. As you wrote, Xorg is opensource - which also means that these limitations exist since there wasn't much of an interest towards addressing them.
Though there is also the bureaucracy aspect - in recent years i've been trying to provide fixes, improvements, etc on various open source projects i'm using and i've noticed that the more involvement there is by companies in a project, especially among maintainers, the more bureaucracy and harder it is to get things merged to the point where whenever i see an issue with something that has at least one bigger company behind it, my first instinct is to make my own fork, fix it there and leave it at that. Or not bother. Projects that are primarily run by volunteers tend to be way easier to get involved with.