I haven't tried it for more than one client to make sure and i think there are still some things untrusted clients can do, but basically my point is that the functionality for Xorg to treat clients differently is there. I do not think modifying the code to have each untrusted client in its own domain would be too complex if someone cared to look into it (as well as adding further restrictions if necessary) - the main issue here seems to be that nobody really cared much about changing Xorg towards doing that.
But there isn't really any core limitation of how X works that couldn't make it so that, e.g., some "privileged" applications (like the window manager) can decide what other less privileged clients can see and even create "domains" on the fly (as far as the applications are concerned it'd be like clients connecting/disconnecting from the server) for applications to see each other if needed. It could be possible if there were people interested in it (and interested enough to implement it, of course :-P).
But there isn't really any core limitation of how X works that couldn't make it so that, e.g., some "privileged" applications (like the window manager) can decide what other less privileged clients can see and even create "domains" on the fly (as far as the applications are concerned it'd be like clients connecting/disconnecting from the server) for applications to see each other if needed. It could be possible if there were people interested in it (and interested enough to implement it, of course :-P).