I still don't see how it is more secure. If the WM can use IPC and tell wayland 'hey, I want to send this keystroke' or 'what were the keyboard inputs?' then why can't some malicious application do the same?
Can I run multiple wayland servers separate from each other? If not, then I still don't see how wm can prevent a random application from pretending to be a wm but actually being a keylogger.