And when someone violates that trust, do you then tear the house down and build one with only external doors, requiring inhabitants to circle in the yard to move between rooms? The point of the Wayland security model is that the inhabitants of the house do not trust each other, and the architecture of the house must change to accommodate that.

I'm not impressed with the analogy. I am not confused about the goals of Wayland's security model. I am dismayed at the poor judgment elsewhere in computing that has led to its necessity.