>once any client has any kind of X11 access they can snope any kind of keyboard events, including your password at the unlock screen.

Wayland fixes this.