Excuse me for being extra blunt. I don't know if you understand how shitty of a design you advocate. Solid designs do not open users to being attacked and their credentials stolen by malicious applications, including sandboxed ones.
Moving cursor around is a compositor's domain, not some arbitrary application's that decided to fiddle with the user's input.
To you it's an arbitrary program. To the user it's a program they want to work.
An API should not be so preachy about which programs can theoretically be written. It should provide broad mechanisms.
It is very frustrating to work with people who think like you do, that 3 or 4 unrelated projects have to carve up narrow exceptions to how the platform works for every single use case, nominally because of theoretical harm of this exploit no one will write, but actually more based on your ego perception that you know better than every other developer on the planet.
So Wayland has this long list of impossible applications which are doable everywhere else. It's a prima donna.
Moving cursor around is a compositor's domain, not some arbitrary application's that decided to fiddle with the user's input.