It's especially bad because I can already name a vulnerability. The method used by this program (sending SIGSTOP to the pid in _NET_WM_PID) is inherently broken and can be abused by malicious processes into sending signals to the wrong process, because _NET_WM_PID is set by the client and can be anything. It's completely broken and won't work at all if your process is in a pid namespaced sandbox (e.g. docker container, bwrap, firejail, flatpaks, snaps) because the process inside the namespace doesn't know its global pid.

Suffice to say it's disappointing whenever I see tools built this way, using pids for signaling in a GUI is a really bad idea and should be avoided. A way to fix it on Linux would be to pass pidfds around everywhere, unfortunately that's Linux-only and adoption of it is very slow. Another Linux-only option would be to use the cgroup freezer if that ever gets implemented in cgroupsv2.