Absolutely. With local and physical access, attacks are very doable. Starting with a security-conscious architecture means that it's easier to improve over time.

ETA: The main point is that tech and use cases have evolved. This means that architecture of existing components needs to be re-evaluated for whether they are still a good way of accomplishing a task. In the case of X.org/X11, the architecture is more challenging to secure due to fundamental design. Wayland may not have full parity for remote use yet but, currently, security is generally a higher priority, so, its newer architecture that DOES consider security and sandboxing gives a better starting point in that area.

I fully anticipate that Wayland will also be replaced in the future as tech and use evolves further (does it consider AR/XR? Man-Machine-Interfaces that might see adoption? etc.). Like biology, it's the nature of tech to evolve and, since there isn't a sign that bad actors will be absent in the future, Wayland's architecture will likely end up being insufficient to secure against input logging attacks of the future.